CVE-2000-1027

Sentinel/Defender KQL

// This query is conceptual and requires specific log sources for Cisco PIX Firewall FTP traffic.
// Look for a high volume of FTP PASV commands from a single source IP to a target FTP server.
// Example: Assuming 'CiscoPIXLogs' table with 'SourceIp', 'DestinationIp', 'FtpCommand' fields.
CiscoPIXLogs
| where FtpCommand == "PASV"
| summarize RequestCount = count() by SourceIp, DestinationIp, bin(TimeGenerated, 1m)
| where RequestCount > 20 // Threshold for flood, adjust as needed
| project TimeGenerated, SourceIp, DestinationIp, RequestCount

Splunk SPL

# This query is conceptual and requires specific log sources for Cisco PIX Firewall FTP traffic.
# Look for a high volume of FTP PASV commands from a single source IP to a target FTP server.
# Example: Assuming 'cisco_pix_logs' sourcetype with 'src_ip', 'dest_ip', 'ftp_command' fields.
sourcetype=cisco_pix_logs ftp_command="PASV"
| stats count as RequestCount by src_ip, dest_ip, _time span=1m
| where RequestCount > 20 # Threshold for flood, adjust as needed
| table _time, src_ip, dest_ip, RequestCount

Sigma

title: Cisco PIX FTP PASV Flood for Internal IP Disclosure
id: 00000000-0000-0000-0000-000000001027
status: experimental
description: Detects a high volume of FTP PASV requests to a server behind a Cisco PIX Firewall, which might indicate an attempt to disclose internal IP addresses.
author: SecBoard
date: 2023/10/27
logsource:
  product: firewall
  vendor: cisco
  service: pix
detection:
  selection:
    ftp_command: 'PASV'
  timeframe: 1m
  condition: selection | stats count() by source_ip, destination_ip having count() > 20
  # Adjust the threshold '20' based on normal traffic patterns
level: medium

Elastic ES|QL

// This query is conceptual and requires specific log sources for Cisco PIX Firewall FTP traffic.
// Look for a high volume of FTP PASV commands from a single source IP to a target FTP server.
// Example: Assuming 'cisco.pix.logs' index with 'source.ip', 'destination.ip', 'ftp.command' fields.
FROM cisco.pix.logs
| WHERE ftp.command == "PASV"
| RARE source.ip, destination.ip, @timestamp
| STATS RequestCount = COUNT() BY source.ip, destination.ip, RUNDOWN(@timestamp, 1m)
| WHERE RequestCount > 20 // Threshold for flood, adjust as needed
| SELECT @timestamp, source.ip, destination.ip, RequestCount