Cisco Secure Firewall - Lumma Stealer Activity

This analytic detects Lumma Stealer activity using Cisco Secure Firewall Intrusion Events. It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where four or more specific Snort signature IDs occur within a 15-minute span from the same host. This behavior is highly indicative of a successful infection by Lumma Stealer.