Unauthorized On-Premises SPAN/RSPAN/ERSPAN Configuration for Passive Traffic Exfiltration

// Requires syslog/TACACS+ command accounting from network devices ingested into a custom table (NetworkDeviceSyslog_CL) with fields: TimeGenerated, DeviceName, Username, SourceIP, CommandText
// Signal 1: SPAN/RSPAN/ERSPAN configuration command logged via TACACS+ accounting or Cisco CFGLOG syslog
let SpanConfigCommands =
NetworkDeviceSyslog_CL
| where TimeGenerated > ago(24h)
| where CommandText has_any ("monitor session", "erspan-source", "erspan-id", "destination ip address", "port-mirroring")
| project TimeGenerated, DeviceName, Username, SourceIP, CommandText, Signal = "SpanConfigChange";
// Extract any destination IP embedded in an ERSPAN destination command
let ErspanDestinations =
SpanConfigCommands
| where CommandText has "destination ip address"
| extend DestIP = extract(@"destination ip address (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})", 1, CommandText)
| where isnotempty(DestIP);
// Signal 2: GRE flow (IP protocol 47, used by ERSPAN) to the same destination shortly after the config change
// Requires flow telemetry ingested into a NetworkFlowLogs table with fields: TimeGenerated, SourceIP, DestinationIP, Protocol, Bytes
let GreFlowsToDest =
NetworkFlowLogs
| where TimeGenerated > ago(24h)
| where Protocol == "GRE" or Protocol == "47"
| project TimeGenerated, SourceIP, DestinationIP, Bytes;
ErspanDestinations
| join kind=inner (GreFlowsToDest) on $left.DestIP == $right.DestinationIP
| where TimeGenerated1 > TimeGenerated and TimeGenerated1 < TimeGenerated + 1h
| project ConfigTime = TimeGenerated, DeviceName, Username, SourceIP, CommandText, DestIP, GreFlowTime = TimeGenerated1, GreBytes = Bytes
| sort by GreFlowTime desc

index=network_syslog sourcetype IN ("cisco:ios", "cisco:asa", "tacacs:accounting")
(CommandText="*monitor session*" OR CommandText="*erspan-source*" OR CommandText="*erspan-id*" OR CommandText="*destination ip address*" OR CommandText="*port-mirroring*")
| rex field=CommandText "destination ip address (?<DestIP>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| eval Signal="SpanConfigChange"
| join type=inner DestIP
  [ search index=network_flows (protocol="GRE" OR protocol="47")
    | rename dest_ip as DestIP
    | eval GreFlowTime=_time
    | table DestIP, GreFlowTime, bytes ]
| where GreFlowTime > _time AND GreFlowTime < _time + 3600
| table _time, host, Username, SourceIP, CommandText, DestIP, GreFlowTime, bytes
| sort - GreFlowTime

sequence by destination.ip with maxspan=1h
  [any where event.dataset == "network_device.syslog" and
     message : ("*monitor session*", "*erspan-source*", "*erspan-id*", "*port-mirroring*") and
     message : "*destination ip address*"]
  [network where event.type == "connection" and network.transport == "gre"]

SELECT
    DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
    LOGSOURCENAME(logsourceid) AS Device,
    username AS Username,
    sourceip AS ManagementSourceIP,
    "CommandText" AS Command
FROM events
WHERE (
    LOWER("CommandText") LIKE '%monitor session%'
    OR LOWER("CommandText") LIKE '%erspan-source%'
    OR LOWER("CommandText") LIKE '%erspan-id%'
    OR LOWER("CommandText") LIKE '%port-mirroring%'
)
AND LOGSOURCETYPENAME(devicetype) IN ('Cisco IOS', 'TACACS')
AND starttime > NOW() - 86400000
ORDER BY starttime DESC

_sourceCategory=network/syslog
(CommandText matches "*monitor session*" OR CommandText matches "*erspan-source*" OR CommandText matches "*erspan-id*" OR CommandText matches "*port-mirroring*")
| parse regex field=CommandText "destination ip address (?<DestIP>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" nodrop
| eval Signal = "SpanConfigChange"
| fields _messageTime, Device, Username, CommandText, DestIP, Signal
| sort by _messageTime desc

rule rogue_span_erspan_config {
  meta:
    author = "df00tech"
    description = "Detects unauthorized SPAN/RSPAN/ERSPAN configuration on network devices, optionally correlated with subsequent GRE flow to the configured destination"
    severity = "HIGH"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1020.001"
    reference = "https://attack.mitre.org/techniques/T1020/001/"

  events:
    $e.metadata.event_type = "GENERIC_EVENT"
    re.regex($e.metadata.description, `(?i)(monitor session|erspan-source|erspan-id|port-mirroring)`)

  condition:
    $e
}

// CrowdStrike LogScale — network device syslog and flow ingestion (not native Falcon endpoint telemetry)
#event_simpleName=NetworkDeviceSyslog
| CommandText=/(?i)(monitor session|erspan-source|erspan-id|port-mirroring)/
| regex(field=CommandText, regex="destination ip address (?<DestIP>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})")
| join(query={#event_simpleName=NetworkFlow | Protocol="GRE"}, field=[DestIP], key=[DestinationIP], mode=inner)
| table(["@timestamp", DeviceName, Username, CommandText, DestIP, Bytes])
| sort(field="@timestamp", order=desc)