Cisco ASA Exploitation Activity - Proxy

Detects suspicious requests to Cisco ASA WebVpn via proxy logs associated with CVE-2025-20333 and CVE-2025-20362 exploitation.

View on GitHub Open raw file

Detection logic

selection

cs-method: GET
cs-uri-stem:
  - /+CSCOU+/MacTunnelStart.jar
  - /+CSCOL+/csvrloader64.cab
  - /+CSCOL+/csvrloader.jar

Condition

selection

Raw YAML

title: Cisco ASA Exploitation Activity - Proxy
id: 15697955-6a29-47ca-92e9-0e05efae3260
status: experimental
description: |
    Detects suspicious requests to Cisco ASA WebVpn via proxy logs associated with CVE-2025-20333 and CVE-2025-20362 exploitation.
references:
    - https://x.com/defusedcyber/status/1971492272966598683
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-11-20
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2025-20333
    - cve.2025-20362
    - detection.emerging-threats
logsource:
    category: proxy
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem:
            - '/+CSCOU+/MacTunnelStart.jar'
            - '/+CSCOL+/csvrloader64.cab'
            - '/+CSCOL+/csvrloader.jar'
    condition: selection
falsepositives:
    - Unknown
level: high

False positives

Unknown

References

https://x.com/defusedcyber/status/1971492272966598683

Similar rules

CVE-2023-1389 Potential Exploitation Attempt - Unauthenticated Command Injection In TP-Link Archer AX21

medium

Shares T1190

CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Proxy)

medium

Shares T1190

CVE-2023-46747 Exploitation Activity - Proxy

high

Shares T1190

CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy

high

Shares T1190