Sunturai
Back to results
InformationalSplunk security contentNasreddine Bencherchali +1

Cisco Secure Firewall - Communication Over Suspicious Ports

The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. It leverages Cisco…

Description

The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. It leverages Cisco Secure Firewall Threat Defense logs and monitors destination ports against a list of non-standard, high-risk port values often used in post-exploitation scenarios. Adversaries frequently configure tools like netcat, Meterpreter, or other backdoors to listen or connect over uncommon ports such as 4444, 2222, or 51820 to bypass standard monitoring and firewall rules. If confirmed malicious, this activity may represent command and control (C2) tunneling, lateral movement, or unauthorized remote access.

Detection logic

Detection requirements

Platform
ESXiIaaSLinuxmacOSNetwork DevicesWindows

The rule states no platform. This is derived from the 6 ATT&CK techniques it maps to.

Log source category
cisco_secure_firewall_threat_defense_connection_event

Known benign triggers

  • Some legitimate services or custom applications may use non-standard ports for development, remote management, or internal communication. Ephemeral ports in test environments may occasionally overlap with ports used in this detection. Additional context such as process name, user behavior, or endpoint telemetry should be used to validate suspicious sessions before escalation.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice