Emerging Threathightest

Cisco ASA FTD Exploit CVE-2020-3452

Detects exploitation attempts on Cisco ASA FTD systems exploiting CVE-2020-3452 with a status code of 200 (sccessful exploitation)

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Florian Roth (Nextron Systems)Created Thu Jan 07Updated Mon Jan 02aba47adc-4847-4970-95c1-61dce62a8b292020

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Web Server Log

CategoryWeb Server Log← raw: webserver

HTTP access logs from web servers capturing request paths, methods, and status codes.

Detection Logic

detection:
    selection_endpoint:
        cs-uri-query|contains:
            - '+CSCOT+/translation-table'
            - '+CSCOT+/oem-customization'
    selection_path_select:
        cs-uri-query|contains:
            - '&textdomain=/'
            - '&textdomain=%'
            - '&name=/'
            - '&name=%'
    select_status_code:
        sc-status: 200
    condition: selection_endpoint and selection_path_select and select_status_code