some legitimate services or custom applications may use non-standard ports for development, remote management, or internal communication. ephemeral ports in test environments may occasionally overlap with ports used in this detection. additional context such as process name, user behavior, or endpoint telemetry should be used to validate suspicious sessions before escalation.

splunk

Techniques

Sample rules

Cisco Secure Firewall - Communication Over Suspicious Ports

source: splunk
technicques:

Description

The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. It leverages Cisco Secure Firewall Threat Defense logs and monitors destination ports against a list of non-standard, high-risk port values often used in post-exploitation scenarios. Adversaries frequently configure tools like netcat, Meterpreter, or other backdoors to listen or connect over uncommon ports such as 4444 or 2222 to bypass standard monitoring and firewall rules.

Detection logic

`cisco_secure_firewall`
EventType=ConnectionEvent
dest_port>1024
dest_port<49151


| where (
    ```Same digit ports, i.e 4444, 55555```
    (
        isint(dest_port/1111)
        AND dest_port<10000
    )
    OR
    isint(dest_port/11111)

    ```Ports with sequentially increasing digits, i.e 1234, 12345```
    OR
    (
        isint((dest_port-123)/1111)
        AND dest_port<7000
    )
    OR
    isint((dest_port-1234)/11111)

    ```Ports with sequentially decreasing digits, i.e 4321```
    OR
    (
        isint((dest_port+123)/1111)
        AND dest_port>4000
        AND dest_port<10000
    )
)


| fillnull value="unknown" url


| stats min(_time) as firstTime
        max(_time) as lastTime
        values(src_port) as src_port
        values(url) as url
        values(rule) as rule

  count by src dest dest_port transport action


| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `cisco_secure_firewall___communication_over_suspicious_ports_filter`