Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12 detections
Filters
Last updated
All Time
Detection languages
6
4
2
Contributors
6
3
3
Categories
6
5
5
4
4
Platforms
10
2
1
Products / Services
6
4
4
2
1
MITRE Techniques
6
5
5
4
4
CVEs
71
71
64
58
49
IDS Classtypes
3
2
IDS Protocols
5
1
This rule monitors for high-impact configuration API calls and the creation of new administrator accounts within the Cisco Secure Firewall Management Center (FMC). These actions are indicative of post-exploitation activity related to CVE-2026-20079, which allows for authentication bypass. The detection focuses on sensitive administrative actions such as policy deployment, certificate exports, and user account creation which, if performed without valid session context, suggest an unauthorized actor.
Detects the creation of web shell-consistent files (.jsp, .jspx, .php, .cgi) within sensitive web application directories on Cisco Firepower Management Center (FMC) appliances. This rule is designed to identify potential post-exploitation activity associated with the authentication bypass vulnerability CVE-2026-20079, which has been observed being used by various threat actors to deploy web shells.
Detects network traffic patterns indicative of a Netcat-based reverse shell associated with the UAT-11823 (Sandworm) threat group. The rule monitors for characteristic command output such as 'uid=' and 'gid=', shell error strings containing '/bin/sh', and root shell prompts ('root@#') following suspected exploitation of CVE-2026-20079.
Detects unauthorized or suspicious POST requests to the Cisco Firepower Management Center (FMC) web interface that lack standard authentication headers (Cookie, Authorization, or X-Api-Token). This pattern is consistent with exploit attempts targeting CVE-2026-20079.
Detects HTTP requests attempting to access 'cmd.jar' on Cisco Firepower Management Center (FMC) devices, which is indicative of post-exploitation activity related to CVE-2026-20079, where an attacker may be attempting to retrieve or upload a command executor.
Detects an attempt to exploit CVE-2026-20079 in Cisco Firepower Management Center (FMC) by targeting the home.jsp file with a specific malicious parameter string indicating post-exploitation activity.
Detects unauthorized or suspicious POST requests to the Cisco Firepower Management Center (FMC) web interface that lack standard authentication headers (Cookie, Authorization, or X-Api-Token). This pattern is consistent with exploit attempts targeting CVE-2026-20079.
Detects successful authentication events to the Cisco Secure Firepower Management Center (FMC) web management interface involving low-privileged or read-only user accounts. This pattern is potentially associated with exploitation of vulnerabilities such as CVE-2026-20316, which may be leveraged for privilege escalation or unauthorized access.
Detects successful authentication events to the Cisco Secure Firepower Management Center (FMC) web management interface involving low-privileged or read-only user accounts. This pattern is potentially associated with exploitation of vulnerabilities such as CVE-2026-20316, which may be leveraged for privilege escalation or unauthorized access.
Detects unauthorized or suspicious POST requests to the Cisco Firepower Management Center (FMC) web interface that lack standard authentication headers (Cookie, Authorization, or X-Api-Token). This pattern is consistent with exploit attempts targeting CVE-2026-20079.
Detects successful authentication events to the Cisco Secure Firepower Management Center (FMC) web management interface involving low-privileged or read-only user accounts. This pattern is potentially associated with exploitation of vulnerabilities such as CVE-2026-20316, which may be leveraged for privilege escalation or unauthorized access.
Detects successful authentication events to the Cisco Secure Firepower Management Center (FMC) web management interface involving low-privileged or read-only user accounts. This pattern is potentially associated with exploitation of vulnerabilities such as CVE-2026-20316, which may be leveraged for privilege escalation or unauthorized access.