CVE-2024-20353

Sentinel/Defender KQL

CiscoASAEvent
| where EventID == "113004" or EventID == "113005" // Device reload events
| where Message contains "unexpected reload" or Message contains "crash"
| join kind=inner (CiscoASAEvent
    | where EventID == "302013" or EventID == "302014" // HTTP connection events
    | where DstPort == 443 or DstPort == 8443 // Common SSL VPN/Management ports
    | summarize RequestCount=count() by SrcIPAddress, DstIPAddress, DstPort, bin(TimeGenerated, 1m)
    | where RequestCount > 10 // Adjust threshold based on normal traffic
) on DstIPAddress, DstPort
| project TimeGenerated, SrcIPAddress, DstIPAddress, DstPort, Message

Splunk SPL

index=cisco_asa (event_id=113004 OR event_id=113005) (message="unexpected reload" OR message="crash")
| join type=inner _time (index=cisco_asa (event_id=302013 OR event_id=302014) (dest_port=443 OR dest_port=8443)
    | stats count as RequestCount by src_ip, dest_ip, dest_port, _time
    | where RequestCount > 10)
| table _time, src_ip, dest_ip, dest_port, message

Sigma

title: Cisco ASA/FTD Web Services DoS Attempt
status: experimental
description: Detects potential DoS attempts against Cisco ASA/FTD web services by looking for unusual HTTP request patterns followed by device reloads.
logsource:
  product: cisco
  service: asa
detection:
  http_requests:
    EventID: ["302013", "302014"]
    DstPort: [443, 8443]
    # Add more specific patterns for crafted HTTP requests if available
  device_reload:
    EventID: ["113004", "113005"]
    Message|contains: ["unexpected reload", "crash"]
  condition: http_requests and device_reload
  timeframe: 5m # Reload should happen shortly after suspicious requests
falsepositives:
  - Legitimate reloads (e.g., maintenance, configuration changes) if not correlated with suspicious HTTP traffic.
level: high

Elastic ES|QL

FROM cisco_asa_logs
| WHERE event.id IN ('113004', '113005') AND (message LIKE '%unexpected reload%' OR message LIKE '%crash%')
| JOIN (FROM cisco_asa_logs
    | WHERE event.id IN ('302013', '302014') AND destination.port IN (443, 8443)
    | GROUP BY source.ip, destination.ip, destination.port, date_trunc('minute', @timestamp)
    | HAVING count() > 10
) ON destination.ip = destination.ip AND destination.port = destination.port
| SELECT @timestamp, source.ip, destination.ip, destination.port, message