LoFP LoFP / legitimate users and applications may use these domains for benign purposes such as file transfers, collaborative development, or storing public content. developer tools, browser extensions, or open-source software may connect to githubusercontent.com or cdn.discordapp.com as part of normal operation. it is recommended to review the associated process (`eve_process`), user behavior, and frequency of access before classifying the activity as suspicious.

Techniques

Sample rules

Cisco Secure Firewall - Connection to File Sharing Domain

Description

The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. It leverages Cisco Secure Firewall Threat Defense logs and focuses on allowed connections (action=Allow) where the url field matches a list of known data hosting or temporary storage services. While many of these platforms serve legitimate purposes, they are frequently leveraged by adversaries for malware delivery, data exfiltration, command and control (C2) beacons, or staging of encoded payloads. This analytic is valuable for identifying potential abuse of legitimate infrastructure as part of an attacker’s kill chain.

Detection logic

`cisco_secure_firewall`
action IN ("Trust", "Allow", "allowed")
EventType=ConnectionEvent
[
    
| inputlookup file_sharing_domains_lookup
    
| table domain
    
| rename domain as url
]


| lookup local=t file_sharing_domains_lookup domain as url OUTPUT description


| where match(url, "(?i)\b".description."\b")


| stats count min(_time) as firstTime
              max(_time) as lastTime
              values(src_port) as src_port
              values(dest) as dest
              values(dest_port) as dest_port
              values(rule) as rule
              values(url) as url
              values(EVE_Process) as EVE_Process

  by src transport action


| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `cisco_secure_firewall___connection_to_file_sharing_domain_filter`