CVE-2018-0101

Sentinel/Defender KQL

DeviceNetworkEvents
| where RemotePort == 443 // Standard HTTPS/WebVPN Port
| where InitiatingProcessFileName contains "vpn" or InitiatingProcessCommandLine contains "webvpn" // Annahme: VPN-Prozesse
| where RemoteIPType == "Public"
| summarize RequestCount = count() by DeviceName, RemoteIP, bin(Timestamp, 1h)
| where RequestCount > 100 // Schwellenwert für ungewöhnlich viele Anfragen an WebVPN-Schnittstelle
| join kind=leftouter (
    DeviceNetworkEvents
    | where RemotePort == 443
    | where InitiatingProcessFileName contains "vpn" or InitiatingProcessCommandLine contains "webvpn"
    | where RemoteIPType == "Public"
    | where AdditionalFields contains "User-Agent: Open AnyConnect VPN Agent v7.08-265-gae481214-dirty" // Spezifischer User-Agent aus PoC
) on DeviceName, RemoteIP
| project DeviceName, RemoteIP, RequestCount, Timestamp, AdditionalFields

Splunk SPL

index=firewall sourcetype=cisco:asa (dest_port=443 OR dest_port=anyconnect) (action=allow OR action=deny) 
| rex field=_raw "User-Agent: (?<user_agent>[^
]+)" 
| where user_agent="Open AnyConnect VPN Agent v7.08-265-gae481214-dirty" OR _raw LIKE "%<config-auth client=%" 
| stats count by src_ip, dest_ip, user_agent 
| where count > 50

Sigma

title: Cisco ASA CVE-2018-0101 WebVPN Exploit Attempt
status: experimental
description: Detects potential exploitation attempts against Cisco ASA CVE-2018-0101 via crafted XML packets to WebVPN interface.
references:
    - https://www.exploit-db.com/exploits/43986/
logsource:
    product: cisco
    service: asa
detection:
    selection_user_agent:
        cisco_asa_log:
            - 'User-Agent: Open AnyConnect VPN Agent v7.08-265-gae481214-dirty'
    selection_xml_payload:
        cisco_asa_log:
            - '<config-auth client="a" type="a" aggregate-auth-version="a">'
            - '<host-scan-reply>A</host-scan-reply>'
    condition: selection_user_agent or selection_xml_payload
level: critical

Elastic ES|QL

from cisco_asa_logs
| where event.dataset == "cisco.asa"
| where (http.request.user_agent == "Open AnyConnect VPN Agent v7.08-265-gae481214-dirty" or http.request.body.content contains "<config-auth client=\"a\" type=\"a\" aggregate-auth-version=\"a\">")
| summarize count() by source.ip, destination.ip, http.request.user_agent
| where count > 10