huntrule

Cisco ASA FTD web exploitation attempt matching CVE-2020-3452 with HTTP 200

Detects HTTP 200 requests targeting Cisco ASA/FTD web parameters associated with CVE-2020-3452 exploit behavior.

FreeReviewedSigma · High · v5
Category
webserver
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-01-07
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Initial Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies HTTP requests to Cisco ASA FTD web endpoints that contain specific query parameters associated with CVE-2020-3452 exploitation attempts and require an HTTP response status code of 200. Successful (200) responses indicate the target application processed the request, which can be consistent with exploitation activity rather than failed probing. It relies on webserver telemetry that includes the request URI query string and the HTTP status code.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange
Possible SharePoint ToolShell ToolPane Exploitation Attempt (via webserver)
Possible Apache ActiveMQ Exploitation via Java Spawning Command Shell (via process_creation)
Malicious Veeam CVE-2023-27532 Exploitation Enabling xp_cmdshell via VeeamHax (via process_creation)
Suspicious PraisonAI Unauthenticated Config Endpoint Access via Webserver
Malicious Langflow Build Public Temp RCE Access via Webserver
Suspicious PraisonAI Vulnerability Scanner User Agent via Webserver
Malicious LiteLLM Authentication SQL Injection via Web Request (via webserver)
Possible Marimo Unauthenticated Terminal WebSocket Access via Web Request (via webserver)
Possible React2Shell Next.js Prototype Pollution Exploitation via Web Request (via webserver)
Cisco ASA FTD web exploitation attempt matching CVE-2020-3452 with HTTP 200
Pivot detection · T1190 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.