Cisco FMC/SCC Deserialization RCE Exploitation (CVE-2026-20131)

let suspiciousUAParts = dynamic(["java", "python-requests", "curl", "wget", "exploit"]);
let fmcPorts = dynamic([443, 8080, 8443]);
union
(
  CommonSecurityLog
  | where DeviceVendor == "Cisco" and DeviceProduct has_any ("Firepower", "FMC", "FireSIGHT")
  | where Activity has_any ("deserialization", "java.lang.Runtime", "ProcessBuilder", "ClassLoader", "ObjectInputStream")
  | project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationIP, Activity, AdditionalExtensions
),
(
  AzureNetworkAnalytics_CL
  | where L7Protocol_s == "https" and DestPort_d in (fmcPorts)
  | where FlowStatus_s == "A"
  | join kind=inner (
      ThreatIntelligenceIndicator
      | where Active == true and NetworkIP != ""
      | project ThreatIP = NetworkIP, ThreatType
    ) on $left.SrcIP_s == $right.ThreatIP
  | project TimeGenerated, SrcIP_s, DestIP_s, DestPort_d, ThreatType
),
(
  DeviceNetworkEvents
  | where RemotePort in (fmcPorts)
  | where InitiatingProcessFileName in~ ("java", "java.exe", "sh", "bash", "python", "python3")
  | where RemoteUrl has_any ("fmc", "firesight", "firepower")
  | project TimeGenerated, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine
),
(
  Syslog
  | where SyslogMessage has_any ("deserialization", "ObjectInputStream", "ClassNotFoundException", "java.lang.Runtime.exec", "ProcessBuilder")
  | where Computer has_any ("fmc", "firesight", "sfmc")
  | project TimeGenerated, Computer, SyslogMessage, HostName
)
| order by TimeGenerated desc

index=network OR index=cisco_fmc OR index=syslog
| eval is_fmc_host=if(match(host, "(?i)(fmc|firesight|sfmc|firepower)"), 1, 0)
| eval is_deser_indicator=if(match(_raw, "(?i)(deserialization|ObjectInputStream|ClassNotFoundException|java\.lang\.Runtime|ProcessBuilder|ysoserial|CommonsCollections)"), 1, 0)
| eval is_suspicious_proc=if(match(process_name, "(?i)(java|sh|bash|python|python3|wget|curl)"), 1, 0)
| where is_fmc_host=1 AND (is_deser_indicator=1 OR is_suspicious_proc=1)
| eval risk_score=case(
    is_deser_indicator=1 AND is_suspicious_proc=1, 90,
    is_deser_indicator=1, 70,
    is_suspicious_proc=1, 40,
    true(), 10
  )
| stats count, max(risk_score) as max_risk, values(src_ip) as src_ips, values(dest_port) as dest_ports, list(_raw) as raw_events by host, _time
| where max_risk >= 70
| sort - max_risk
| table _time, host, src_ips, dest_ports, max_risk, count, raw_events

sequence by host.name with maxspan=5m
  [network where destination.port in (443, 8080, 8443)
   and host.name like~ "*fmc*" or host.name like~ "*firesight*"
   and not source.ip like "10.*" and not source.ip like "192.168.*"]
  [process where host.name like~ "*fmc*"
   and process.name in ("java", "sh", "bash", "python", "python3", "wget", "curl")
   and process.parent.name in ("java", "tomcat", "httpd", "sfmcd")]
  [file where host.name like~ "*fmc*"
   and (file.extension in ("jsp", "war", "class") or file.path like "/tmp/*" or file.path like "/var/tmp/*")]
| head 100

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  logsourcename(logsourceid) AS log_source,
  UTF8(payload) AS raw_payload,
  QIDNAME(qid) AS event_name,
  magnitude
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Cisco Firepower Management Center', 'Cisco FireSIGHT', 'Linux OS')
  AND (
    UTF8(payload) ILIKE '%deserialization%'
    OR UTF8(payload) ILIKE '%ObjectInputStream%'
    OR UTF8(payload) ILIKE '%ClassNotFoundException%'
    OR UTF8(payload) ILIKE '%java.lang.Runtime%'
    OR UTF8(payload) ILIKE '%ProcessBuilder%'
    OR UTF8(payload) ILIKE '%ysoserial%'
    OR UTF8(payload) ILIKE '%CommonsCollections%'
  )
  AND LAST 24 HOURS
ORDER BY magnitude DESC, starttime DESC
LIMIT 500

_sourceCategory=cisco/fmc OR _sourceCategory=linux/syslog
| where _sourceHost matches "*fmc*" or _sourceHost matches "*firesight*"
| parse regex "(?i)(?P<deser_keyword>deserialization|ObjectInputStream|ClassNotFoundException|java\.lang\.Runtime\.exec|ProcessBuilder|ysoserial|CommonsCollections)"
| where !isNull(deser_keyword)
| parse field=_raw "src=*" as src_ip nodrop
| parse field=_raw "dst=*" as dst_ip nodrop
| parse field=_raw "dpt=*" as dst_port nodrop
| count by _sourceHost, src_ip, deser_keyword, _messagetime
| sort by _messagetime desc

rule CVE_2026_20131_Cisco_FMC_Deserialization_RCE {
  meta:
    author = "df00tech detection engineering"
    description = "Detects potential exploitation of CVE-2026-20131 via Java deserialization in Cisco FMC"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh"

  events:
    (
      $e1.metadata.event_type = "NETWORK_CONNECTION"
      and (
        $e1.target.hostname = /(?i)(fmc|firesight|sfmc|firepower)/
        or $e1.target.application = /(?i)(cisco.*fmc|firepower.*management)/
      )
      and $e1.target.port in (443, 8080, 8443)
      and not re.regex($e1.principal.ip, `^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.).*`)
    )
    or
    (
      $e1.metadata.event_type = "PROCESS_LAUNCH"
      and re.regex($e1.principal.hostname, `(?i)(fmc|firesight|sfmc)`)
      and $e1.target.process.file.full_path = /\/(java|sh|bash|python|python3|wget|curl)$/
      and re.regex($e1.principal.process.file.full_path, `(?i)(java|tomcat|httpd|sfmcd)`)
    )
    or
    (
      $e1.metadata.event_type = "GENERIC_EVENT"
      and re.regex($e1.principal.hostname, `(?i)(fmc|firesight|sfmc)`)
      and re.regex($e1.metadata.description, `(?i)(deserialization|ObjectInputStream|ClassNotFoundException|java\.lang\.Runtime|ProcessBuilder)`)
    )

  condition:
    $e1
}

// CVE-2026-20131 - Cisco FMC Deserialization RCE
// Detect suspicious process chains from FMC/Tomcat services or deserialization indicators
(
  event_simpleName=ProcessRollup2
  | search ParentBaseFileName IN ("java", "tomcat", "catalina.sh", "sfmcd")
    AND FileName IN ("sh", "bash", "python", "python3", "wget", "curl", "nc", "ncat", "perl")
    AND (ComputerName CONTAINS "fmc" OR ComputerName CONTAINS "firesight" OR ComputerName CONTAINS "sfmc")
  | eval risk="high - suspicious child process from FMC service"
)
OR
(
  event_simpleName=NetworkConnectIP4
  | search (LocalPort IN ("443", "8080", "8443"))
    AND (ComputerName CONTAINS "fmc" OR ComputerName CONTAINS "firesight")
    AND RemoteAddressIP4 != /^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)/
  | eval risk="medium - inbound connection to FMC from non-RFC1918 source"
)
OR
(
  event_simpleName=SuspiciousRawDiskRead
  | search (ComputerName CONTAINS "fmc" OR ComputerName CONTAINS "firesight")
  | eval risk="critical - suspicious disk activity on FMC host post-exploitation"
)
| fields _time, ComputerName, FileName, ParentBaseFileName, CommandLine, RemoteAddressIP4, LocalPort, risk
| sort -_time