Detection rules for Firepower Data sources. Every rule contains its MITRE ATT&CK mapping, an impact rating, and details on what it identifies.
This category lists 5 detection rules.
| Rule | Category | Technique | Impact (C/I/A) |
|---|---|---|---|
| Advanced Malware Protection (AMP) Alert Detection | Initial Access | T1566 - Phishing | C:3 / I:3 / A:2 |
| Command and Control on Non-Standard Ports | Command and Control | T1571 - Non-Standard Port | C:3 / I:2 / A:1 |
| Firepower IOC (Indicator of Compromise) Detection | Initial Access | T1566 - Phishing | C:3 / I:3 / A:2 |
| Intrusion Prevention System High Priority Events | Execution | T1203 - Exploitation for Client Execution | C:3 / I:3 / A:3 |
| Threat Intelligence Director (TID) Alert Detection | Command and Control | T1071.001 - Application Layer Protocol: Web Protocols | C:3 / I:3 / A:2 |
Rule Example
Below is an example of a rule definition for Advanced Malware Protection (AMP) Alert Detection (view in repository):
# Rule version v1.0.0
dataTypes:
- firewall-cisco-firepower
name: Advanced Malware Protection (AMP) Alert Detection
impact:
confidentiality: 3
integrity: 3
availability: 2
category: Initial Access
technique: "T1566 - Phishing"
adversary: origin
references:
- https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/file_malware_events_and_network_file_trajectory.html
- https://attack.mitre.org/techniques/T1566/
description: |
Detects when Cisco Firepower Advanced Malware Protection (AMP) identifies malware or malicious files, including retrospective detections and high threat score files. This rule triggers on various malware dispositions including confirmed malware, custom detections, retrospective malware (files later identified as malicious), and files with high threat scores (>=70).
Next Steps:
1. Identify the affected host using the origin.ip and log.deviceName fields
2. Review the file hash (log.sha256) in threat intelligence databases
3. Check if the malware was successfully blocked or if remediation is needed
4. Look for lateral movement attempts from the affected host
5. Verify if other hosts accessed the same malicious file
6. Consider isolating the affected system if malware execution is confirmed
7. Review the file trajectory to understand the infection vector
8. Update endpoint protection rules to prevent similar infections
where: |
equals("log.eventType", "MALWARE_EVENT") &&
(equals("log.disposition", "MALWARE") ||
equals("log.disposition", "CUSTOM_DETECTION") ||
equals("log.disposition", "RETROSPECTIVE_MALWARE") ||
greaterOrEqual("log.threatScore", 70))
groupBy:
- lastEvent.log.sha256
- adversary.ip
Rule Details
Advanced Malware Protection (AMP) Alert Detection
Detects instances where Cisco Firepower Advanced Malware Protection (AMP) finds malware or malicious files, covering retrospective detections and files with high threat scores. This rule triggers for multiple malware dispositions, such as confirmed malware, custom detections, retrospective malware (files later identified as malicious), and files with threat scores >=70.
Category: Initial Access
Technique: T1566 - Phishing
Impact: C:3 / I:3 / A:2
Rule file: advanced_malware_protection_alerts.yml
Reference: https://attack.mitre.org/techniques/T1566/
Command and Control on Non-Standard Ports
Detects connections over non-standard ports that could signal command and control (C2) communication. It identifies HTTP traffic on non-HTTP ports, encrypted traffic on unexpected ports, and application protocol mismatches found by Firepower's application identification engine.
Category: Command and Control
Technique: T1571 - Non-Standard Port
Impact: C:3 / I:2 / A:1
Rule file: c2_nonstandard_port.yml
Reference: https://attack.mitre.org/techniques/T1571/
Firepower IOC (Indicator of Compromise) Detection
Detects when Firepower finds an Indicator of Compromise (IOC), which suggests a host might be infected with malware or compromised. IOCs may include file hashes, malware signatures, or behavioral patterns that point to malicious activity.
Category: Initial Access
Technique: T1566 - Phishing
Impact: C:3 / I:3 / A:2
Rule file: ioc_matches.yml
Reference: https://attack.mitre.org/tactics/TA0040/
Reference: https://attack.mitre.org/techniques/T1566/
Intrusion Prevention System High Priority Events
Identifies high-priority IPS events originating from Cisco Firepower that may signal exploitation attempts, zero-day attacks, or targeted critical vulnerabilities. Such events constitute immediate threats demanding urgent investigation.
Category: Execution
Technique: T1203 - Exploitation for Client Execution
Impact: C:3 / I:3 / A:3
Rule file: intrusion_prevention_high_priority_events.yml
Reference: https://attack.mitre.org/techniques/T1203/
Threat Intelligence Director (TID) Alert Detection
Detects when Cisco Firepower Threat Intelligence Director finds connections to known malicious indicators, including IPs, domains, URLs, and SHA256 hashes from threat feeds. This rule triggers when TID blocks, or would block, connections based on threat intelligence matches with high confidence scores.
Category: Command and Control
Technique: T1071.001 - Application Layer Protocol: Web Protocols
Impact: C:3 / I:3 / A:2
Rule file: threat_intelligence_director_alerts.yml
Reference: https://attack.mitre.org/techniques/T1071/