CVE-2025-20393 — Cisco Multiple Products Improper Input Validation (KEV)

union DeviceNetworkEvents, CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where DeviceVendor == "Cisco" or SourceSystem contains "Cisco"
| where (RequestURL contains "sma" and (RequestURL matches regex @"(?i)(\.\./|%2e%2e%2f|%252e|;|%3b|\x00|null%00)")
  or Activity contains "input validation"
  or AdditionalExtensions contains "CVE-2025-20393")
| extend AttackerIP = coalesce(SourceIP, RemoteIP)
| extend TargetDevice = coalesce(DeviceName, Computer, DestinationHostName)
| project TimeGenerated, AttackerIP, TargetDevice, RequestURL, Activity, AdditionalExtensions, SourceSystem
| order by TimeGenerated desc

index=network OR index=cisco sourcetype=cisco:* OR sourcetype=syslog
| eval request_lower=lower(uri_path)
| where match(request_lower, "(\.\./|%2e%2e%2f|%252e|;%00|null%00|\.%00|\/cgi-bin\/|exec=)")
  OR match(uri_path, "(?i)(CVE-2025-20393)")
  OR (vendor="Cisco" AND match(message, "(?i)(invalid input|input validation failed|malformed request|unexpected token)"))
| eval attacker_ip=coalesce(src_ip, src)
| eval target_host=coalesce(dest_host, dest_ip, host)
| stats count as attempt_count, values(uri_path) as observed_paths, earliest(_time) as first_seen, latest(_time) as last_seen by attacker_ip, target_host, sourcetype
| where attempt_count > 1
| sort -attempt_count

sequence by source.ip with maxspan=5m
  [network where event.category == "network" and
   (destination.port in (80, 443, 8080, 8443) and
    (url.path : ("*../*", "*%2e%2e%2f*", "*%252e*", "*;*", "*%00*")) and
    (observer.vendor : "Cisco" or tags : "cisco"))
  ] with runs=2

SELECT sourceip, destinationip, destinationport, URL, "Log Source", QIDNAME(qid) as EventName, starttime
FROM events
WHERE (devicevendor ILIKE '%cisco%' OR category = 'Cisco')
  AND (
    URL ILIKE '%../%'
    OR URL ILIKE '%2e%2e%2f%'
    OR URL ILIKE '%252e%'
    OR URL ILIKE '%;%00%'
    OR LOWER("utf8(payload)") ILIKE '%input validation%'
    OR LOWER("utf8(payload)") ILIKE '%cve-2025-20393%'
  )
  AND starttime > NOW() - 7 DAYS
ORDER BY starttime DESC
LIMIT 1000

_sourceCategory=cisco* OR _sourceCategory=network/cisco
| where _raw matches /(\.\.\/|%2e%2e%2f|%252e|;|%00|null%00)/
  OR _raw matches /(?i)(input.?validation|malformed.?request|invalid.?input)/
  OR _raw matches /(?i)(CVE-2025-20393)/
| parse regex field=_raw "src_ip=(?<src_ip>[\d\.]+)" nodrop
| parse regex field=_raw "dest_ip=(?<dest_ip>[\d\.]+)" nodrop
| parse regex field=_raw "uri=(?<uri>[^\s]+)" nodrop
| where !isNull(src_ip)
| timeslice 1h
| stats count as attempts, values(uri) as uris by src_ip, dest_ip, _timeslice
| where attempts > 3
| sort by attempts desc

rule cve_2025_20393_cisco_input_validation {
  meta:
    author = "df00tech"
    description = "Detects CVE-2025-20393 exploitation — Cisco improper input validation"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.application = /(?i)cisco/
    (
      $e.network.http.request_url = /(\.\.\/|%2e%2e%2f|%252e|;|%00)/
      or $e.metadata.description = /(?i)(input validation|malformed|invalid input)/
    )
    $src_ip = $e.principal.ip

  match:
    $src_ip over 5m

  outcome:
    $event_count = count_distinct($e.metadata.id)
    $target_hosts = array_distinct($e.target.hostname)

  condition:
    #e > 2
}

event_simpleName IN ("NetworkConnectIP4", "HttpRequest", "ProcessRollup2")
| filter (DeviceVendor="Cisco" OR CommandLine=/(?i)cisco/)
  AND (
    HttpRequestUri=/(\.\.\/|%2e%2e%2f|%252e|;|\x00)/
    OR CommandLine=/(?i)(input.?validation|CVE-2025-20393|sma.*attack)/
  )
| eval attacker_ip=coalesce(RemoteAddressIP4, LocalAddressIP4)
| stats count() as hits, values(HttpRequestUri) as uris, values(CommandLine) as cmds by attacker_ip, ComputerName, timestamp
| where hits > 1
| sort -hits