Detection: Cisco Secure Firewall - Communication Over Suspicious Ports

Description

The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. It leverages Cisco Secure Firewall Threat Defense logs and monitors destination ports against a list of non-standard, high-risk port values often used in post-exploitation scenarios. Adversaries frequently configure tools like netcat, Meterpreter, or other backdoors to listen or connect over uncommon ports such as 4444 or 2222 to bypass standard monitoring and firewall rules.

Search

 1`cisco_secure_firewall`
 2EventType=ConnectionEvent
 3dest_port>1024
 4dest_port<49151
 5
 6
 7| where (
 8    ```Same digit ports, i.e 4444, 55555```
 9    (
10        isint(dest_port/1111)
11        AND dest_port<10000
12    )
13    OR
14    isint(dest_port/11111)
15
16    ```Ports with sequentially increasing digits, i.e 1234, 12345```
17    OR
18    (
19        isint((dest_port-123)/1111)
20        AND dest_port<7000
21    )
22    OR
23    isint((dest_port-1234)/11111)
24
25    ```Ports with sequentially decreasing digits, i.e 4321```
26    OR
27    (
28        isint((dest_port+123)/1111)
29        AND dest_port>4000
30        AND dest_port<10000
31    )
32)
33
34
35| fillnull value="unknown" url
36
37
38| stats min(_time) as firstTime
39        max(_time) as lastTime
40        values(src_port) as src_port
41        values(url) as url
42        values(rule) as rule
43
44  count by src dest dest_port transport action
45
46
47| `security_content_ctime(firstTime)`
48
49| `security_content_ctime(lastTime)`
50
51| `cisco_secure_firewall___communication_over_suspicious_ports_filter`

Data Source

Name	Platform	Sourcetype	Source
Cisco Secure Firewall Threat Defense Connection Event	Network	'cisco:sfw:estreamer'	'not_applicable'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

This search requires Cisco Secure Firewall Threat Defense Logs, which includes the ConnectionEvent EventType. This search uses an input macro named cisco_secure_firewall. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404). The access policy must also enable logging. The search uses a hardcoded list of suspicious ports, you might want to tune those according to your environment

Known False Positives

Some legitimate services or custom applications may use non-standard ports for development, remote management, or internal communication. Ephemeral ports in test environments may occasionally overlap with ports used in this detection. Additional context such as process name, user behavior, or endpoint telemetry should be used to validate suspicious sessions before escalation.

Associated Analytic Story

• Cisco Secure Firewall Threat Defense Analytics

Intermediate Findings

Threat Objects

References

• https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 9