CVE-2026-20002

Sentinel/Defender KQL

CiscoFMCLogs
| where EventType == "WebAccess" and Url contains "/api/" // Oder spezifischere Pfade der Management-Oberfläche
| where HttpRequestMethod in ("POST", "GET")
| where Url contains "'" or Url contains "--" or Url contains "union select" or Url contains "waitfor delay" or Url contains "benchmark("
| summarize count() by SourceIp, DestinationIp, Url, HttpRequestMethod, HttpStatusCode
| where count_ > 5 // Schwellenwert für wiederholte Versuche anpassen
| project SourceIp, DestinationIp, Url, HttpRequestMethod, HttpStatusCode, count_

Splunk SPL

sourcetype="cisco:fmc:weblogs" (uri_path="/api/*" OR uri_path="/admin/*") (method="POST" OR method="GET") (uri="*'" OR uri="*--*" OR uri="*union select*" OR uri="*waitfor delay*" OR uri="*benchmark(*")
| stats count by src_ip, dest_ip, uri, method, status
| where count > 5
| table src_ip, dest_ip, uri, method, status, count

Sigma

title: Cisco FMC SQL Injection Attempt
logsource:
  product: cisco
  service: fmc
detection:
  selection:
    event_type: "WebAccess"
    url|contains:
      - "/api/"
      - "/admin/"
    http_request_method:
      - "POST"
      - "GET"
    url|contains:
      - "'"
      - "--"
      - "union select"
      - "waitfor delay"
      - "benchmark("
  condition: selection
  timeframe: 5m
  level: high

Elastic ES|QL

FROM cisco_fmc_logs
| WHERE event.type == "WebAccess" AND (url.path LIKE "/api/%" OR url.path LIKE "/admin/%")
| WHERE http.request.method IN ("POST", "GET")
| WHERE url.full LIKE "%'%" OR url.full LIKE "%--%" OR url.full LIKE "%union select%" OR url.full LIKE "%waitfor delay%" OR url.full LIKE "%benchmark(%"
| GROUP BY source.ip, destination.ip, url.full, http.request.method, http.response.status_code
| AGG count = count()
| WHERE count > 5
| COLUMNS source.ip, destination.ip, url.full, http.request.method, http.response.status_code, count