Cisco Secure Firewall - Communication Over Suspicious Ports
Description
The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. It leverages Cisco Secure Firewall Threat Defense logs and monitors destination ports against a list of non-standard, high-risk port values often used in post-exploitation scenarios. Adversaries frequently configure tools like netcat, Meterpreter, or other backdoors to listen or connect over uncommon ports such as 4444 or 2222 to bypass standard monitoring and firewall rules.
Query · spl
`cisco_secure_firewall`
EventType=ConnectionEvent
dest_port>1024
dest_port<49151
| where (
```Same digit ports, i.e 4444, 55555```
(
isint(dest_port/1111)
AND dest_port<10000
)
OR
isint(dest_port/11111)
```Ports with sequentially increasing digits, i.e 1234, 12345```
OR
(
isint((dest_port-123)/1111)
AND dest_port<7000
)
OR
isint((dest_port-1234)/11111)
```Ports with sequentially decreasing digits, i.e 4321```
OR
(
isint((dest_port+123)/1111)
AND dest_port>4000
AND dest_port<10000
)
)
| fillnull value="unknown" url
| stats min(_time) as firstTime
max(_time) as lastTime
values(src_port) as src_port
values(url) as url
values(rule) as rule
count by src dest dest_port transport action
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `cisco_secure_firewall___communication_over_suspicious_ports_filter`
Implementation guide
This search requires Cisco Secure Firewall Threat Defense Logs, which includes the ConnectionEvent EventType.
This search uses an input macro named cisco_secure_firewall. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs.
Replace the macro definition with configurations for your Splunk environment.
The search also uses a post-filter macro designed to filter out known false positives.
The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
The access policy must also enable logging.
The search uses a hardcoded list of suspicious ports, you might want to tune those according to your environment
Known false positives
- Some legitimate services or custom applications may use non-standard ports for development, remote management, or internal communication. Ephemeral ports in test environments may occasionally overlap with ports used in this detection. Additional context such as process name, user behavior, or endpoint telemetry should be used to validate suspicious sessions before escalation.
Analyst notes
Known false positives: Some legitimate services or custom applications may use non-standard ports for development, remote management, or internal communication. Ephemeral ports in test environments may occasionally overlap with ports used in this detection. Additional context such as process name, user behavior, or endpoint telemetry should be used to validate suspicious sessions before escalation.