Suspicious Cisco ASA WebVPN GET Requests via Proxy Logs Indicating Exploitation Attempts

Alerts on proxy-observed HTTP GET requests to specific Cisco ASA WebVPN exploit-related URI stems.

FreeUnreviewedSigmahighv1

suspicious-cisco-asa-webvpn-get-requests-via-proxy-logs-indicating-exploitation--15697955

title: Suspicious Cisco ASA WebVPN GET Requests via Proxy Logs Indicating Exploitation Attempts
id: 6bd1ed6a-9aac-4ce8-a7e1-e46aa6f81185
status: experimental
description: This rule flags proxy log traffic where HTTP GET requests target specific Cisco ASA WebVPN paths associated with exploitation activity. Attackers may use these crafted requests to deliver or trigger malicious components on exposed VPN services. The detection relies on proxy telemetry capturing the HTTP method and requested URI stems that match the listed patterns.
references:
  - https://x.com/defusedcyber/status/1971492272966598683
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-20333/proxy_exploit_cve_2025_20333.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-20
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2025-20333
  - cve.2025-20362
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  selection:
    cs-method: GET
    cs-uri-stem:
      - /+CSCOU+/MacTunnelStart.jar
      - /+CSCOL+/csvrloader64.cab
      - /+CSCOL+/csvrloader.jar
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 15697955-6a29-47ca-92e9-0e05efae3260
    type: derived

What it detects

This rule flags proxy log traffic where HTTP GET requests target specific Cisco ASA WebVPN paths associated with exploitation activity. Attackers may use these crafted requests to deliver or trigger malicious components on exposed VPN services. The detection relies on proxy telemetry capturing the HTTP method and requested URI stems that match the listed patterns.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.