CVE-2025-20333

Sentinel/Defender KQL

CiscoASAEvent
| where EventID == "419001" or EventID == "419002" // VPN session events
| where Message contains "HTTP" and Message contains "malformed" or Message contains "unexpected"
| extend RequestPath = extract(@"Request: ([^\s]+)", 1, Message)
| summarize count() by DstIP, RequestPath, bin(TimeGenerated, 1h)
| where count_ > 5 // Adjust threshold based on baseline
| join kind=leftouter (
    DeviceProcessEvents
    | where FileName in ("sh", "bash", "cmd.exe", "powershell.exe")
    | where InitiatingProcessFileName == "httpd" or InitiatingProcessFileName == "vpn_web_server"
    | summarize count() by DeviceName, FileName, InitiatingProcessFileName, bin(TimeGenerated, 1h)
) on $left.DstIP == $right.DeviceName
| where isnotempty(FileName)
| project DstIP, RequestPath, FileName, InitiatingProcessFileName, TimeGenerated, count_
| union (
    CiscoASAEvent
    | where EventID == "113004" // Device reload/restart
    | summarize count() by DstIP, bin(TimeGenerated, 1h)
    | where count_ > 1 // Multiple reloads in short period
    | project DstIP, TimeGenerated, count_
)

Splunk SPL

sourcetype=cisco:asa (event_id=419001 OR event_id=419002) (message=*HTTP* AND (message=*malformed* OR message=*unexpected*))
| rex "Request: (?<RequestPath>[^\s]+)"
| stats count by dest_ip, RequestPath, _time
| where count > 5
| join type=left (
    sourcetype=cisco:ftd:process (process_name=sh OR process_name=bash OR process_name=cmd.exe OR process_name=powershell.exe) (parent_process_name=httpd OR parent_process_name=vpn_web_server)
    | stats count by host, process_name, parent_process_name, _time
) on dest_ip=host
| where isnotnull(process_name)
| fields dest_ip, RequestPath, process_name, parent_process_name, _time, count
| append [
    sourcetype=cisco:asa event_id=113004 // Device reload/restart
    | stats count by dest_ip, _time
    | where count > 1
    | fields dest_ip, _time, count
]

Sigma

title: Cisco ASA/FTD VPN Web Server RCE Attempt
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects potential exploitation attempts against Cisco ASA/FTD VPN Web Server vulnerability (CVE-2025-20333) by looking for suspicious HTTP requests and subsequent process execution or device reloads.
author: SecBoard
date: 2025/11/06
modified: 2025/11/06
references:
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB
logsource:
  product: cisco
  service: asa
detection:
  selection_http:
    EventID:
      - '419001'
      - '419002'
    Message|contains_all:
      - 'HTTP'
      - 'malformed'
  selection_process:
    product: linux
    service: process_creation
    ParentImage|endswith:
      - 'httpd'
      - 'vpn_web_server'
    Image|endswith:
      - '/bin/sh'
      - '/bin/bash'
      - '/bin/cmd.exe'
      - '/bin/powershell.exe'
  selection_reload:
    EventID: '113004'
  condition: (selection_http and selection_process) or selection_reload
falsepositives:
  - Legitimate system reloads (for selection_reload, if not correlated with other suspicious activity)
level: high

Elastic ES|QL

FROM cisco_asa_logs
| WHERE event.id == "419001" OR event.id == "419002"
| WHERE message LIKE "%HTTP%" AND (message LIKE "%malformed%" OR message LIKE "%unexpected%")
| GROK message, "Request: %{NOTSPACE:request_path}"
| STATS count() BY destination.ip, request_path, TIMESTAMP_FLOOR(event.ingested, INTERVAL 1 HOUR)
| WHERE count > 5
| JOIN (
    FROM process_events
    | WHERE process.executable IN ("sh", "bash", "cmd.exe", "powershell.exe")
    | WHERE process.parent.executable IN ("httpd", "vpn_web_server")
    | STATS count() BY host.name, process.executable, process.parent.executable, TIMESTAMP_FLOOR(event.ingested, INTERVAL 1 HOUR)
) ON destination.ip = host.name
| WHERE NOT IS_NULL(process.executable)
| SELECT destination.ip, request_path, process.executable, process.parent.executable, event.ingested, count
| UNION (
    FROM cisco_asa_logs
    | WHERE event.id == "113004"
    | STATS count() BY destination.ip, TIMESTAMP_FLOOR(event.ingested, INTERVAL 1 HOUR)
    | WHERE count > 1
    | SELECT destination.ip, event.ingested, count
)