UTMSTACK logoUTMSTACK logo
Cisco Firepower

Detection rules for Firepower data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects.

This category contains 5 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
Advanced Malware Protection (AMP) Alert DetectionInitial AccessT1566 - PhishingC:3 / I:3 / A:2
Command and Control on Non-Standard PortsCommand and ControlT1571 - Non-Standard PortC:3 / I:2 / A:1
Firepower IOC (Indicator of Compromise) DetectionInitial AccessT1566 - PhishingC:3 / I:3 / A:2
Intrusion Prevention System High Priority EventsExecutionT1203 - Exploitation for Client ExecutionC:3 / I:3 / A:3
Threat Intelligence Director (TID) Alert DetectionCommand and ControlT1071.001 - Application Layer Protocol: Web ProtocolsC:3 / I:3 / A:2

Rule Example

Below is an example of a rule definition for Advanced Malware Protection (AMP) Alert Detection (view in repository):

# Rule version v1.0.0

dataTypes:
  - firewall-cisco-firepower
name: Advanced Malware Protection (AMP) Alert Detection
impact:
  confidentiality: 3
  integrity: 3
  availability: 2
category: Initial Access
technique: "T1566 - Phishing"
adversary: origin
references:
  - https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/file_malware_events_and_network_file_trajectory.html
  - https://attack.mitre.org/techniques/T1566/
description: |
  Detects when Cisco Firepower Advanced Malware Protection (AMP) identifies malware or malicious files, including retrospective detections and high threat score files. This rule triggers on various malware dispositions including confirmed malware, custom detections, retrospective malware (files later identified as malicious), and files with high threat scores (>=70).

  Next Steps:
  1. Identify the affected host using the origin.ip and log.deviceName fields
  2. Review the file hash (log.sha256) in threat intelligence databases
  3. Check if the malware was successfully blocked or if remediation is needed
  4. Look for lateral movement attempts from the affected host
  5. Verify if other hosts accessed the same malicious file
  6. Consider isolating the affected system if malware execution is confirmed
  7. Review the file trajectory to understand the infection vector
  8. Update endpoint protection rules to prevent similar infections
where: |
  equals("log.eventType", "MALWARE_EVENT") && 
  (equals("log.disposition", "MALWARE") || 
   equals("log.disposition", "CUSTOM_DETECTION") ||
   equals("log.disposition", "RETROSPECTIVE_MALWARE") ||
   greaterOrEqual("log.threatScore", 70))
groupBy:
  - lastEvent.log.sha256
  - adversary.ip

Rule Details

Advanced Malware Protection (AMP) Alert Detection

Detects when Cisco Firepower Advanced Malware Protection (AMP) identifies malware or malicious files, including retrospective detections and high threat score files. This rule triggers on various malware dispositions including confirmed malware, custom detections, retrospective malware (files later identified as malicious), and files with high threat scores (>=70).

Command and Control on Non-Standard Ports

Detects connections on non-standard ports that may indicate command and control (C2) communication. Identifies HTTP traffic on non-HTTP ports, encrypted traffic on unexpected ports, and application protocol mismatches detected by Firepower's application identification engine.

Firepower IOC (Indicator of Compromise) Detection

Detects when Firepower identifies an Indicator of Compromise (IOC), indicating a host may be infected with malware or compromised. IOCs can include file hashes, malware signatures, or behavioral patterns that suggest malicious activity.

Intrusion Prevention System High Priority Events

Detects high priority IPS events from Cisco Firepower indicating potential exploitation attempts, zero-day attacks, or critical vulnerabilities being targeted. These events represent immediate threats that require urgent investigation.

Threat Intelligence Director (TID) Alert Detection

Detects when Cisco Firepower Threat Intelligence Director identifies connections to known malicious indicators including IPs, domains, URLs, and SHA256 hashes from threat feeds. This rule triggers when TID blocks or would block connections based on threat intelligence matches with high confidence scores.