Analytics Story: Suspicious Cisco Adaptive Security Appliance Activity

Date: 2025-11-19 ID: 5d9e31a4-64df-4f13-b9da-6b2dc40e0c1e Author: Bhavin Patel, Nasreddine Bencherchali, Splunk Product: Splunk Enterprise Security

Description

This analytic story provides a suite of detections built to analyze telemetry generated by Cisco Adaptive Security Appliance (ASA) devices.

It focuses on identifying anomalous, suspicious or potentially malicious activity such as logging suppression, unauthorized configuration changes, anomalous connection patterns, unexpected drops in core syslog message volume, and potential command-and-control (C2) behaviors.

These detections help defenders surface behavior on security edge devices that may indicate defense evasion, exploitation attempts, or device tampering.

Why it matters

Cisco ASA/FTD appliances are commonly deployed at network boundaries to enforce security policies, inspect traffic, and provide remote access. As critical control-plane devices, their logs and operational telemetry can reveal adversary behavior ranging from configuration tampering and logging suppression to exploitation and C2.

Monitoring activity from Cisco ASA and FTD devices is critical because these appliances serve as key security controls at the network perimeter. Analyzing their telemetry and syslog data helps organizations maintain visibility into device health, policy enforcement, and potential threats.

Regular monitoring enables early detection of unusual or unauthorized activity, supports compliance requirements, and strengthens the overall security posture by ensuring that any deviations from expected behavior are promptly investigated.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Cisco ASA - AAA Policy Tampering	Network Device Authentication	Anomaly
Cisco ASA - Core Syslog Message Volume Drop	Impair Defenses	Hunting
Cisco ASA - Device File Copy Activity	Data from Local System, Data from Cloud Storage	Anomaly
Cisco ASA - Device File Copy to Remote Location	Data from Local System, Exfiltration Over C2 Channel, Exfiltration Over Unencrypted Non-C2 Protocol	Anomaly
Cisco ASA - Logging Disabled via CLI	Impair Defenses	TTP
Cisco ASA - Logging Filters Configuration Tampering	Impair Defenses	Anomaly
Cisco ASA - Logging Message Suppression	Disable Windows Event Logging, Indicator Removal	Anomaly
Cisco ASA - New Local User Account Created	Local Account, Local Accounts	Anomaly
Cisco ASA - Packet Capture Activity	Network Sniffing, Adversary-in-the-Middle	Anomaly
Cisco ASA - Reconnaissance Command Activity	System Information Discovery, Domain Properties, IP Addresses	Anomaly
Cisco ASA - User Account Deleted From Local Database	Account Access Removal, Clear Mailbox Data	Anomaly
Cisco ASA - User Account Lockout Threshold Exceeded	Password Guessing, Password Spraying	Anomaly
Cisco ASA - User Privilege Level Change	Local Accounts, Account Manipulation	Anomaly

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Cisco ASA Logs	Other	`cisco:asa`	`not_applicable`

References

Source: GitHub | Version: 2