LoFP / blocked connection events are generated via an access control policy on the firewall management console. hence no false positives should be present.

Techniques

• T1018
• T1046
• T1110
• T1203
• T1595.002

Sample rules

Cisco Secure Firewall - Blocked Connection

• source: splunk
• technicques:
  • T1018
  • T1046
  • T1110
  • T1203
  • T1595.002

Description

The following analytic detects a blocked connection event by identifying a “Block” value in the action field. It leverages logs from Cisco Secure Firewall Threat Defense devices. This activity is significant as it can identify attempts from users or applications initiating network connection to explicitly or implicitly blocked range or zones. If confirmed malicious, attackers could be attempting to perform a forbidden action on the network such as data exfiltration, lateral movement, or network disruption.

Detection logic

`cisco_secure_firewall` EventType=ConnectionEvent action=Block

| stats count min(_time) as firstTime max(_time) as lastTime by src_ip, dest, dest_port, transport, rule, url, EVE_Process, action

| `security_content_ctime(firstTime)` 

| `security_content_ctime(lastTime)` 

| `cisco_secure_firewall___blocked_connection_filter`