CVE-2020-3580

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "chrome.exe" or InitiatingProcessFileName =~ "msedge.exe" or InitiatingProcessFileName =~ "firefox.exe"
| where ProcessCommandLine contains "cisco-asa-ftd-web-interface-url" and ProcessCommandLine contains "<script>" or ProcessCommandLine contains "javascript:"
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, RemoteUrl
// Ersetzen Sie 'cisco-asa-ftd-web-interface-url' durch die tatsächliche URL Ihrer Cisco ASA/FTD Weboberfläche.
// Diese Abfrage sucht nach Browser-Prozessen, die möglicherweise manipulierte URLs mit Skript-Injektionen öffnen.

Splunk SPL

index=web sourcetype=access_combined
| where uri_path like "%/admin%" OR uri_path like "%/vpn%" // Anpassung an typische ASA/FTD Admin/VPN Pfade
| where user_agent like "Mozilla%" AND (uri like "*<script>*" OR uri like "*javascript:*" OR uri like "*data:text/html;base64,*")
| stats count by clientip, uri, user_agent
// Diese Abfrage sucht in Webserver-Zugriffslogs nach URLs, die potenziell XSS-Payloads enthalten und auf die Cisco ASA/FTD Weboberfläche abzielen könnten.

Sigma

title: Cisco ASA FTD XSS Attempt
status: experimental
description: Detects potential Cross-Site Scripting (XSS) attempts against Cisco ASA/FTD web interface.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3580
logsource:
  category: webserver
  product: generic
detection:
  selection:
    c-uri|contains:
      - '<script>'
      - 'javascript:'
      - 'data:text/html;base64,'
    c-uri|contains:
      - '/admin'
      - '/vpn'
  condition: selection
falsepositives:
  - Legitimate web traffic with unusual parameters (requires tuning)
level: medium

Elastic ES|QL

FROM logs-webserver-access-*
| WHERE url.path LIKE '%/admin%' OR url.path LIKE '%/vpn%'
| WHERE url.query LIKE '%<script>%' OR url.query LIKE '%javascript:%' OR url.query LIKE '%data:text/html;base64,%'
| STATS count() BY source.ip, url.original, user_agent.original
// Diese Abfrage sucht in Webserver-Zugriffslogs nach URLs, die potenziell XSS-Payloads enthalten und auf die Cisco ASA/FTD Weboberfläche abzielen könnten.