Coverage › CVE-2023-20269

CVE-2023-20269 Mapped Sigma

Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability

Vendor / product

Cisco — Adaptive Security Appliance and Firepower Threat Defense

Description (CISA)

Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user.

Added to KEV

2023-09-13

Due date

2023-10-04

Required action

Apply mitigations per vendor instructions for group-lock and vpn-simultaneous-logins or discontinue use of the product for unsupported devices.

Known ransomware use

Known

CWE

CWE-288

CISA notes

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ravpn-auth-8LyfCkeC
https://nvd.nist.gov/vuln/detail/CVE-2023-20269

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

2 mapping objects across 2 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1078 Valid Accounts primary impact

• DET0560 Detection of Valid Account Abuse Across Platforms
  AN1543 Windows

  Detection of compromised or misused valid accounts via anomalous logon patterns, abnormal logon types, and inconsistent geographic or time-based activity across Windows endpoints.

  WinEventLog:Security EventCode=4624 → DC0067 Logon Session Creation

  WinEventLog:Security EventCode=4776, 4625 → DC0002 User Account Authentication

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: LogonType TimeWindow GeoIPMismatch
  AN1544 Linux

  Detection of valid account misuse through SSH logins, sudo/su abuse, and service account anomalies outside expected patterns.

  auditd:SYSCALL execve → DC0032 Process Creation

  NSM:Connections sshd or PAM logins → DC0002 User Account Authentication

  Tunable: UserContext HostDensityThreshold LoginMethod
  AN1545 macOS

  Detection of interactive and remote logins by service accounts or users at unusual times, with unexpected child process activity.

  macos:unifiedlog loginwindow, sshd → DC0088 Logon Session Metadata

  macos:unifiedlog exec logs → DC0032 Process Creation

  Tunable: LoginOrigin ProcessTreeDepth
  AN1546 Identity Provider

  Detection of valid account abuse in IdP logs via geographic anomalies, impossible travel, risky sign-ins, and multiple MFA attempts or failures.

  saas:okta Sign-in logs / audit events → DC0002 User Account Authentication

  Tunable: MFAFailureCount RiskScoreThreshold IPGeoVelocity
  AN1547 Containers

  Detection of containerized service accounts or compromised kubeconfigs being used for cluster access from unexpected nodes or IPs.

  kubernetes:audit authentication.k8s.io → DC0002 User Account Authentication

  Tunable: ServiceAccountScope ClusterIPWhitelist

Sigma rules tagged attack.t1078 (56)

All 56 rules on the technique page →

T1133 External Remote Services exploitation technique

• DET0354 Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers
  AN1004 Windows

  Unusual or unauthorized external remote access attempts (e.g., RDP, VPN, Citrix) → repeated failed logins followed by a successful session from uncommon geolocations or outside business hours → subsequent internal lateral movement or data exfiltration activities.

  WinEventLog:Security EventCode=4776, 4625 → DC0002 User Account Authentication

  WinEventLog:Application VPN, Citrix, or remote access gateway logs showing external IP addresses → DC0038 Application Log Content

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: BusinessHours KnownRemoteIPs FailedLogonThreshold GeoIPWhitelist TimeWindow
  AN1005 Linux

  Repeated SSH, VPN, or RDP gateway authentication attempts from external IPs → subsequent successful logon → remote shell or lateral movement activity (e.g., scp/sftp).

  auditd:SYSCALL ssh logins or execve of remote commands → DC0088 Logon Session Metadata

  NSM:Connections Failed password or accepted password for SSH users → DC0038 Application Log Content

  NSM:Flow connection: Inbound connections to SSH or VPN ports → DC0082 Network Connection Creation

  Tunable: KnownSSHClients FailedLogonThreshold TimeWindow
  AN1006 macOS

  Unexpected inbound or outbound VNC/SSH/Screen Sharing connections from external sources → repeated failed logins followed by success → remote interactive sessions or abnormal file transfers.

  macos:unifiedlog Remote login (ssh) or screen sharing authentication attempts → DC0088 Logon Session Metadata

  macos:unifiedlog Inbound connections to VNC/SSH ports → DC0082 Network Connection Creation

  PF:Logs External traffic to remote access services → DC0078 Network Traffic Flow

  Tunable: KnownVNCServers TimeWindow
  AN1007 Containers

  Connections to exposed container services (e.g., Docker API, Kubernetes API server) from unauthorized external IPs → abnormal container creation/start → lateral activity within cluster nodes.

  ApplicationLog:API Docker/Kubernetes API access from external sources → DC0038 Application Log Content

  kubernetes:audit Unauthorized container creation or kubelet exec logs → DC0088 Logon Session Metadata

  NSM:Flow External access to container ports (2375, 6443) → DC0082 Network Connection Creation

  Tunable: AllowedCIDRs TimeWindow

Sigma rules tagged attack.t1133 (20)

All 20 rules on the technique page →