ID | Technique | Tactic |
---|---|---|
T1021 | Remote Services | Lateral Movement |
T1055 | Process Injection | Defense Evasion |
T1059.001 | PowerShell | Privilege Escalation |
T1105 | Ingress Tool Transfer | Execution |
T1219 | Remote Access Tools | Command And Control |
T1571 | Non-Standard Port | Command And Control |
Detection: Cisco Secure Firewall - Communication Over Suspicious Ports
Description
The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. It leverages Cisco Secure Firewall Threat Defense logs and monitors destination ports against a list of non-standard, high-risk port values often used in post-exploitation scenarios. Adversaries frequently configure tools like netcat, Meterpreter, or other backdoors to listen or connect over uncommon ports such as 4444, 2222, or 51820 to bypass standard monitoring and firewall rules. If confirmed malicious, this activity may represent command and control (C2) tunneling, lateral movement, or unauthorized remote access.
Search
1`cisco_secure_firewall` EventType=ConnectionEvent dest_port IN ("888", "999", "2200", "2222", "4000", "4444", "6789", "8531", "50501", "51820")
2| fillnull value="unknown" url
3
4| stats min(_time) as firstTime max(_time) as lastTime
5 values(src_port) as src_port
6 values(url) as url
7 values(rule) as rule
8 count by src_ip, dest, dest_port, transport, action
9
10| `security_content_ctime(firstTime)`
11
12| `security_content_ctime(lastTime)`
13
14| `cisco_secure_firewall___communication_over_suspicious_ports_filter`
Data Source
Name | Platform | Sourcetype | Source |
---|---|---|---|
Cisco Secure Firewall Threat Defense Connection Event | N/A | 'cisco:sfw:estreamer' |
'not_applicable' |
Macros Used
Name | Value |
---|---|
cisco_secure_firewall | sourcetype="cisco:sfw:estreamer" |
cisco_secure_firewall___communication_over_suspicious_ports_filter | search * |
cisco_secure_firewall___communication_over_suspicious_ports_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Risk Event | True |
Implementation
This search requires Cisco Secure Firewall Threat Defense Logs, which
includes the ConnectionEvent EventType. This search uses an input macro named cisco_secure_firewall
.
We strongly recommend that you specify your environment-specific configurations
(index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
with configurations for your Splunk environment. The search also uses a post-filter
macro designed to filter out known false positives.
The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
The access policy must also enable logging.
The search uses a hardcoded list of suspicious ports, you might want to tune those according to your environment
Known False Positives
Some legitimate services or custom applications may use non-standard ports for development, remote management, or internal communication. Ephemeral ports in test environments may occasionally overlap with ports used in this detection. Additional context such as process name, user behavior, or endpoint telemetry should be used to validate suspicious sessions before escalation.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message:
Suspicious communication detected from $src_ip$ to $dest$ over port $dest_port$.
Risk Object | Risk Object Type | Risk Score | Threat Objects |
---|---|---|---|
src_ip | system | 20 | url |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | not_applicable |
cisco:sfw:estreamer |
Integration | ✅ Passing | Dataset | not_applicable |
cisco:sfw:estreamer |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 1