Cyritex News
[Splunk + Cyritex] Joint Solution - Helping Customers Enhance Threat Hunting Capabilities
In today's complex cybersecurity landscape, enterprises face an increasing threat of Advanced Persistent Threats (APTs).
As a leading global Security Information and Event Management (SIEM) platform, Splunk possesses powerful capabilities in log collection, analysis, and visualization. However, in the face of constantly evolving Advanced Persistent Threats, detection rules must be continuously optimized and updated. This often stands as one of the major challenges enterprises encounter in their daily security operations.
To help enterprises fully leverage the powerful capabilities of the Splunk platform in threat detection and correlation analysis, and to continuously optimize and expand Use Cases and detection rules, Splunk and SecXun have jointly launched a solution. This solution aims to significantly enhance customers' threat hunting capabilities through three key areas.
This article will explore the technical details and practical applications of this solution in depth.
I. Verifying and Enriching Security Detection Rules
SecXun helps enterprises comprehensively improve the effectiveness of detection rules through advanced breach and attack simulation technology.
Verify the Effectiveness of Existing Use Cases
In practical applications, security teams often find it difficult to confirm whether existing detection rules can effectively identify the latest attack techniques. SecXun helps enterprises verify the detection rules in Splunk Enterprise Security through a systematic testing approach, ensuring their effectiveness.
▶ Practical Application Example:
Using the Log4j vulnerability (CVE-2021-44228) as an example, SecXun provides nearly 200 attack simulation rules to comprehensively verify the coverage of detection rules:
Through these simulation tests, enterprises can:
Promptly identify blind spots in detection rules
Verify the effectiveness of newly added rules
Ensure timely updates to protective measures
In Splunk Enterprise Security, the relevant default Use Case ("Detecting Log4j remote code execution") can be simulated and fully validated through these corresponding rules to ensure timely and effective detection of respective attack variants.
Source URL:
Identify Potential Detection Blind Spots
Security threats often exploit weak links in the defense system to launch attacks. By comparing the complete attack chain of simulated attacks with actual detection results, potential defensive shortcomings can be effectively identified.
▶ Practical Application Example:
Using DNS tunneling detection as an example, analyzing only DNS server logs may not fully identify data exfiltration behavior. By introducing multidimensional data source analysis, such as DNS traffic characteristics and communication behavior patterns, the coverage and accuracy of detection can be significantly improved.
SecXun simulates various malicious domain resolution and DNS tunneling data exfiltration scenarios to help enterprises establish a more comprehensive detection mechanism:
Default Use Case in Splunk Enterprise Security: Monitoring a network for DNS exfiltration
Source URL:
Provide Additional Detection Rule Recommendations
Based on the latest MITRE ATT&CK framework and threat intelligence, the solution can provide richer detection rules for Splunk Enterprise Security.
▶ Practical Application Example:
Targeting newly emerged DarkSide variants and attacks, SecXun provides dedicated attack simulations, helping Splunk add data source analysis, including network traffic analysis rules (as analyzing only endpoint-side data sources is incomplete) and behavioral detection logic.
SecXun provides attack simulations targeting the Darkside ransomware group:
A. Command and Control Tactics (Several techniques used by this ransomware group)
B. Discovery Tactics (Several techniques used by this ransomware group)
C. Persistence Tactics (Several techniques used by this ransomware group)
D. Command and Control Tactics ("Ingress Tool Transfer" technique used by this ransomware group)
E. Defense Evasion Tactics (Evasion techniques used by this ransomware group)
F. Impact Tactics (Several techniques used by this ransomware group)
Default Use Case in Splunk Enterprise Security: Detecting DarkSide ransomware
Source URL:
https://lantern.splunk.com/Security/UCE/Guided_Insights/Threat_hunting/Detecting_DarkSide_ransomware
▶️ Example of newly added Splunk detection rule:
II. Building Advanced Threat Profiles Based on APT Attack Simulations
Due to their stealthy and persistent nature, Advanced Persistent Threats (APTs) place higher demands on enterprise security defense systems. The joint solution builds a comprehensive APT threat protection system in the following ways:
Simulating Complex APT Attack Chains
Technical Details: SecXun builds complete attack scenarios based on the Tactics, Techniques, and Procedures (TTPs) of real APT groups.
Practical Operations: Simulate the typical attack flow of APT28, including phases such as Initial Access, Privilege Escalation, Lateral Movement, and Data Exfiltration.
Capturing and Analyzing Detailed Logs
Data Collection: The Splunk platform configures advanced data collection strategies, including network traffic, system logs, application logs, and user activities across multiple dimensions.
Analysis Methods: Leverage Splunk's machine learning capabilities, such as anomaly detection algorithms, to identify unusual patterns within the attack chain.
Building Comprehensive APT Group Profiles
Profile Composition: Includes Indicators of Compromise (IoCs), attack tool signatures, network behavior patterns, and data exfiltration techniques.
Application Value: Security teams can leverage these profiles to create more accurate correlation rules and behavioral analysis models in Splunk.
SecXun's simulation covers full-attack-chain APT scenarios:
A. Initial Access Tactics (Several techniques used by this APT group)
B. Persistence Tactics (Several techniques used by this APT group)
C. Command and Control Tactics ("Ingress Tool Transfer" technique used by this APT group)
D. Lateral Movement Tactics (Several techniques used by this APT group)
E. Discovery Tactics (Several techniques used by this APT group)
F. Defense Evasion Tactics (Several techniques used by this APT group)
G. Command and Control Tactics (Several techniques used by this APT group)
H. Exfiltration Tactics (Several techniques used by this APT group)
III. Bridging Security Product Gaps: Upgrading Splunk Platform Detection Capabilities
Even the most advanced security products can have detection blind spots or be targeted and bypassed by attackers.
Splunk strongly recommends that users enable Splunk ES Content Update to continuously update detection rules, enhancing the coverage of threat detection Use Cases and enriching corresponding rules.
Additionally, with the help of the SecXun Security Validation Platform, the detection capabilities of the Splunk platform can be further enhanced in the following ways:
Identifying Detection Blind Spots of Existing Security Products
Testing Method: Use the latest attack techniques, such as fileless attacks, supply chain attacks, and defense evasion attacks, to comprehensively evaluate the enterprise's existing security architecture.
Example Illustration: Discovering that a new ransomware strain can bypass the enterprise's EDR solution.
Providing Detailed Technical Signatures
Signature Extraction: Perform in-depth analysis on each discovered undetected threat, extracting its unique technical signatures and behavioral patterns.
Practical Application: Provide detailed behavioral analysis for the ransomware bypassing EDR, including operating system configurations, file system operations, registry modifications, and network connection patterns.
Adding Targeted Rules on the Splunk Platform
Rule Development: Based on the extracted signatures, develop dedicated Splunk detection rules, typically including SPL (Search Processing Language) queries and associated trigger conditions.
Deployment Example: For the aforementioned ransomware, deploy composite detection rules in Splunk based on operating system activities and network behavior.
Examples of rules from SecXun's attack library:
▶️ Example of newly added Splunk detection rule:
The joint solution of Splunk and SecXun significantly improves enterprises' threat hunting capabilities through systematic attack simulations, comprehensive log analysis, and precise rule optimization. This approach not only effectively addresses current security challenges but also helps enterprises establish a continuously evolving security system. In an increasingly complex cybersecurity environment, this practice-based, continuously optimized approach will undoubtedly become a key weapon for enterprises to defend against advanced threats.
Chenggang Yin, Sales Director of Splunk China
In the security field, threat patterns evolve rapidly, and defense strategies must advance with the times. Our collaboration with SecXun brings more robust threat hunting capabilities to customers, helping them deepen data insights and optimize security management efficiency. SecXun's simulation of attack scenarios significantly enhances the effectiveness of customer experiences on the Splunk platform, achieving a true "1+1>2" value accumulation, keeping customers at the forefront of security defense.
Xiaofeng Tian, Founder & CEO of SecXun
Security defense is never static. Working with Splunk allows us to offer more dynamic and realistic attack simulations, helping customers better identify and improve detection rules. We will remain committed to assisting customers in building continuously optimized security systems, making security defense not just about protection, but about being ready for new challenges at any moment.
Exclusive Benefit for Splunk Users: Three-month Free Trial of SecXun Security Validation Platform Starting today, all Splunk users can try the SecXun Security Validation Platform free for three months.
Let your security team experience the power of real-time attack simulation, optimize detection rules deeply, and fill defense blind spots. With the strong support of SecXun, further strengthen the effectiveness of Splunk usage to build a comprehensive threat protection system.
Limited-time opportunity, be among the first to experience the new heights empowered by "intelligent validation"!
