Three Clusters Exploit Cisco Secure Firewall Management Center to Deploy Web Shells, Cyclops Blink, and Qilin Ransomware

Published on September 19, 2026 | By Focused Hunts

Cisco Talos has confirmed that attackers are actively breaking into a widely used security appliance: the software many organizations rely on to manage their firewalls. A flaw in this software lets an outside attacker with no password take full control of the system that is meant to protect the network. Three separate groups are already using it, from a Russian state-linked team to a ransomware crew.

Think of it like a thief who steals the master key to a building's security office. From that one room, they can watch the cameras, unlock the doors, and decide who gets in. Because the attackers operate from inside a trusted security device, their activity blends in with normal administration and rarely triggers an alarm.

Once inside, the groups steal the passwords stored on the device, map the rest of the network, and quietly tunnel deeper to reach the servers that hold user accounts, email, and files. One group installs long-term spying malware, while another uses the access to launch ransomware. For any organization running the unpatched software, a single compromised appliance can expose the entire network and lead to data theft, surveillance, or a full ransomware shutdown.

Hunting Controls & Observations

Cisco Talos is tracking active exploitation of two vulnerabilities in Cisco Secure Firewall Management Center (FMC) Software. CVE-2026-20079 (CVSS 10.0) is an authentication bypass that lets an unauthenticated, remote attacker execute scripts and obtain root access, and CVE-2026-20316 (CVSS 5.3) lets an attacker sign in with a low-privileged static-credential account that can be chained toward privilege escalation. Talos attributes the post-exploitation activity to three distinct clusters: UAT-12197 deploys web shells and harvests credentials, UAT-11823 overlaps in tooling with the Russian state-sponsored Sandworm actor and deploys the Cyclops Blink implant, and UAT-11988 is assessed with high confidence as a Qilin ransomware affiliate. Because the FMC is a Linux appliance that attackers control as root, the strongest detection opportunities live in network telemetry around the appliance and in the identity and endpoint telemetry of the Windows estate the attackers pivot into. Organizations can detect this activity through multiple telemetry sources:

Network Controls: Firewall and IDS/IPS logs (Cisco Talos published Snort SIDs 66075-66080, 66883, 66960, and 66961), NetFlow and egress records for connections the appliance initiates, and DNS logs including DNS-over-HTTPS used for command-and-control resolution
Endpoint & Appliance Controls: Linux audit or Sysmon-for-Linux telemetry forwarded from the FMC, web server (Tomcat) process and file activity, and file integrity monitoring on /var, /usr/local/sf, and /etc/init.d
Identity & Access Controls: Windows Security event logs for Active Directory reconnaissance and NTLM authentication, Microsoft Defender for Identity query and logon events, and monitoring for reuse of service-account and database credentials
Application & Database Controls: Access to the appliance's internal user and authentication database, and creation of archives that stage managed-device configurations before exfiltration

Behavioral Indicators of Attack

The following behaviors, drawn from the Talos analysis, are more durable than any single indicator because all three clusters rotate infrastructure and reuse legitimate appliance tooling:

A public-facing FMC appliance's web server spawning shell or Java child processes, or writing new files into the Tomcat web root. This is the signature of exploitation followed by a JSP web shell dropped into the CSM Tomcat directory.
The appliance's Java runtime executing bundled administrative utilities such as OmniQuery.pl and package_info.pl with arguments that query the internal user database or unpack an unexpected package file, rather than during normal product operation.
Named-pipe reverse shells, where a process creates a FIFO feeding /bin/sh and pipes the output to an outbound connection on an unusual high port such as 3090.
A trusted appliance making unexpected outbound connections to commercial hosting or cloud IP space, including DNS-over-HTTPS lookups used to resolve command-and-control addresses.
New persistence scripts placed under the appliance's init directory (/etc/init.d/) that were not created by a Cisco software update.
Root-level reconnaissance bursts that collect hostnames, IP addresses, directory listings, Active Directory service accounts, database credentials, and hostname-to-IP mappings for domain controllers, ADFS, Exchange, and file servers in rapid succession.
Establishment of SOCKS proxies and reverse-SSH tunnels that forward internal service ports (directory 389/636, Kerberos 88, SMB 445, NetBIOS 135, and remote management 5985) out to an external host.
Pass-the-hash and remote-execution tooling such as Impacket and Invoke-TheHash authenticating laterally, followed by disabling of endpoint security tools and ransomware deployment on selected systems.

MITRE Enterprise ATT&CK Tactics and Techniques

Talos did not publish formal ATT&CK identifiers, so the mapping below is inferred from the behaviors described in the report and corroborated by public cataloging of the same indicators. The campaign spans the kill chain from initial access through impact:

Initial Access (T1190 – Exploit Public-Facing Application): Attackers exploit the CVE-2026-20079 authentication bypass on the internet-reachable FMC web interface to execute scripts and obtain root on the underlying operating system.
Initial Access (T1078 – Valid Accounts): CVE-2026-20316 allows a remote attacker to log in with a low-privileged static-credential account, which is then chained toward higher-privileged access.
Execution (T1059.004 – Command and Scripting Interpreter: Unix Shell): Commands run through /bin/sh -c, named-pipe reverse shells, and bundled appliance utilities invoked with attacker-supplied arguments.
Persistence (T1505.003 – Server Software Component: Web Shell): UAT-12197 plants a JSP web shell in the CSM Tomcat web root, activated by a Base64-encoded parameter.
Persistence (T1037.004 – Boot or Logon Initialization Scripts: RC Scripts): Cyclops Blink installs persistence scripts under /etc/init.d/ so the implant survives reboots.
Defense Evasion (T1562.001 – Impair Defenses: Disable or Modify Tools): UAT-11988 deploys custom antivirus killers before staging ransomware.
Credential Access (T1003 – OS Credential Dumping): Attackers dump the FMC user and authentication database and harvest Active Directory service-account and MySQL credentials from compromised systems.
Discovery (T1087.002 – Account Discovery: Domain Account): Root-level scripts enumerate domain accounts, service accounts, and computer objects across the environment.
Discovery (T1018 – Remote System Discovery): Reconnaissance maps hostnames to IP addresses for domain controllers, ADFS, Exchange, file servers, and database servers.
Lateral Movement (T1021.004 – Remote Services: SSH): Attackers build reverse-SSH tunnels to reach internal services from outside the network.
Lateral Movement (T1550.002 – Use Alternate Authentication Material: Pass the Hash): Impacket and Invoke-TheHash authenticate to additional hosts using stolen hashes rather than plaintext passwords.
Command and Control (T1090.001 – Proxy: Internal Proxy): A Python SOCKS5 proxy relays attacker traffic through the compromised appliance into the internal network.
Command and Control (T1572 – Protocol Tunneling): Reverse-SSH tunnels forward directory, Kerberos, SMB, NetBIOS, and remote-management ports out to attacker infrastructure.
Command and Control (T1071.004 – Application Layer Protocol: DNS): Cyclops Blink resolves its command-and-control addresses over DNS-over-HTTPS to blend with normal encrypted traffic.
Collection (T1560.001 – Archive Collected Data: Archive via Utility): Bash scripts stage managed-device configurations into archives in preparation for exfiltration.
Exfiltration (T1041 – Exfiltration Over C2 Channel): Collected data leaves the environment over HTTP requests to attacker-controlled infrastructure.
Impact (T1486 – Data Encrypted for Impact): UAT-11988 deploys Qilin ransomware on selected endpoints after credential harvesting and lateral movement.

Controls' Observables

Network Controls

Because the compromised device is a management appliance, network telemetry carries the highest-value signals: a trusted appliance should almost never behave like a client reaching out to the internet.

Appliance-initiated outbound sessions: The FMC opening connections to hosting or cloud IP space, including reverse shells on unusual high ports such as 3090.
- Related MITRE Techniques: T1059.004, T1090.001, T1572
- Detection Difficulty: LOW
DNS-over-HTTPS from the appliance: Encrypted DNS lookups used by Cyclops Blink to resolve command-and-control addresses.
- Related MITRE Techniques: T1071.004
- Detection Difficulty: MEDIUM
Internal port forwarding: Directory, Kerberos, SMB, and remote-management ports tunneled out to an external host through reverse-SSH.
- Related MITRE Techniques: T1572, T1090.001
- Detection Difficulty: MEDIUM
Known campaign infrastructure: Connections to the published scanner and command-and-control IP addresses.
- Related MITRE Techniques: T1190, T1041
- Detection Difficulty: LOW

Endpoint & Appliance Controls

Where the FMC forwards Linux audit or Sysmon-for-Linux telemetry, endpoint data captures the exploitation and persistence stages on the appliance itself.

Web server spawning shells or writing web content: The Tomcat process launching a shell or creating a new .jsp file in the web root.
- Related MITRE Techniques: T1505.003, T1059.004
- Detection Difficulty: MEDIUM
Bundled utility abuse: OmniQuery.pl or package_info.pl invoked to read the user database or unpack an unexpected license.tmp package.
- Related MITRE Techniques: T1003, T1059.004
- Detection Difficulty: MEDIUM
New init persistence: Scripts added under /etc/init.d/ that no Cisco update created.
- Related MITRE Techniques: T1037.004
- Detection Difficulty: MEDIUM
Named-pipe reverse shells: Creation of a FIFO such as /tmp/f that feeds /bin/sh and pipes output to a network connection.
- Related MITRE Techniques: T1059.004
- Detection Difficulty: MEDIUM

Identity & Access Controls

Once attackers pivot off the appliance, the credential-theft and lateral-movement stages surface in Active Directory and Windows authentication telemetry.

Reconnaissance bursts: Rapid enumeration of domain accounts, groups, and computer objects from a single non-administrative source.
- Related MITRE Techniques: T1087.002, T1018
- Detection Difficulty: MEDIUM
Pass-the-hash fan-out: Network NTLM logons from one account or source reaching many hosts in a short window.
- Related MITRE Techniques: T1550.002, T1021.002
- Detection Difficulty: MEDIUM
Harvested credential reuse: Service-account and database credentials used from hosts or times that do not match their normal pattern.
- Related MITRE Techniques: T1078
- Detection Difficulty: HIGH

Application & Database Controls

Application-layer telemetry ties the appliance compromise to concrete data theft.

Internal user-table queries: Reads of the FMC user and authentication database outside normal product operation.
- Related MITRE Techniques: T1003
- Detection Difficulty: MEDIUM
Configuration staging: Creation of archives that bundle managed-device configurations before they leave the network.
- Related MITRE Techniques: T1560.001, T1041
- Detection Difficulty: HIGH

Insights and Recommendation

Organizations that fall victim face root-level control of the very appliance meant to enforce their network policy, theft of the credentials stored on it, and a staging point for deeper intrusion. The three clusters turn that foothold into distinct outcomes: quiet, long-term espionage through a resilient Linux implant; wholesale credential harvesting across Active Directory and databases; and full ransomware encryption of selected systems after security tools are disabled. Because the attackers operate as root from a trusted device and tunnel their traffic through legitimate protocols, dwell time can extend for weeks before the impact stage makes the compromise visible.

As of 2026-09-19, AlienVault OTX catalogs all three malware samples from this campaign across more than a dozen public threat-intelligence pulses that cite the Talos report, and links them to the Cyclops Blink (S0687) and Qilin malware families. AbuseIPDB shows the reverse-shell and scanner addresses carrying low report counts on commercial hosting and cloud providers as of the same date, for example 43.204.2.142 on Amazon AWS infrastructure in India (9 reports) and 89.34.96.56 on UK bare-metal hosting (2 reports), which means reputation feeds alone will not reliably flag them. On the ransomware side, ransomware.live records 2,298 total victims on Qilin's leak site as of 2026-09-19, with the most recent posted 2026-09-18, underscoring that the group behind cluster UAT-11988 remains highly active.

Security teams should apply Cisco's hotfixes for CVE-2026-20079 and CVE-2026-20316 immediately and adopt the hardening release, treating any unpatched, internet-reachable FMC as presumed compromised until proven otherwise. Deploy the Cisco Talos Snort coverage (SIDs 66075-66080, 66883, 66960, and 66961) and restrict management-plane access so the FMC web interface is never exposed to the internet. Because the strongest signal is a trusted appliance behaving like an attacker, alert on any outbound connection the FMC initiates to external or hosting IP space, on DNS-over-HTTPS from the appliance, and on new files in the Tomcat web root or new scripts under /etc/init.d (T1071.004, T1505.003, T1037.004). Downstream, hunt for the credential-theft and lateral-movement stages: rapid Active Directory reconnaissance from a single host (T1087.002), NTLM pass-the-hash logons from Impacket and Invoke-TheHash (T1550.002), and any disabling of endpoint security tools that precedes ransomware staging (T1562.001, T1486). If exploitation is confirmed, rotate every credential stored on or reachable from the appliance, including Active Directory service accounts and database passwords, since the intruders dump these early.

Source and Credits

This summary is based on Cisco Talos's research article "Active exploitation of Cisco Secure Firewall Management Center vulnerabilities" published on September 9, 2026.

Live-status corroboration for selected indicators was provided by Darknet CTI corroboration (Focused Hunts), drawing on AlienVault OTX, AbuseIPDB, and ransomware.live as checked on 2026-09-19. This is a secondary source used only to confirm current infrastructure status, public cataloging, and leak-site activity; all threat behavior and attribution derive from the Cisco Talos report.

Threat Hunting IOCs & Queries

The clusters reuse legitimate appliance tooling and rotate infrastructure, so treat the indicators below as seeds and rely on the behavioral queries for durable detection. The authoritative and complete indicator set is published in the Cisco Talos IOC repository on GitHub (Cisco-Talos/IOCs/tree/main/2026/09).

Known Indicators of Compromise

File Hashes (SHA256):
- b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d – home.jsp web shell (UAT-12197) (AlienVault OTX: cataloged across 13 public pulses tied to this Talos report, as of 2026-09-19)
- db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e – cmd.jar command executor (UAT-12197) (AlienVault OTX: cataloged across 13 public pulses tied to this Talos report, as of 2026-09-19)
- 6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461 – Cyclops Blink implant (UAT-11823) (AlienVault OTX: cataloged across 14 public pulses, malware family Cyclops Blink S0687, as of 2026-09-19)
IP Addresses:
- 89.34.96.56 – UAT-11823 reverse-shell and Cyclops Blink C2 (AbuseIPDB 2% confidence, 1 report, hosted on Hydra Communications / Zare bare-metal in the UK, last reported 2026-09-11, as of 2026-09-19)
- 208.123.119.215 – UAT-11823 Netcat reverse-shell C2, port 3090 (AbuseIPDB 0% confidence, hosted on Shock Hosting LLC in the US, as of 2026-09-19)
- 91.214.78.118 – UAT-11823 Netcat reverse-shell C2 (AbuseIPDB 2% confidence, 1 report, hosted on IP TEAM LLC in the Netherlands, as of 2026-09-19)
- 104.218.165.253 – UAT-11823 CVE-2026-20079 vulnerability scanner (AbuseIPDB 0 reports, hosted on UCLOUD, as of 2026-09-19)
- 43.204.2.142 – UAT-11988 (Qilin) intrusion IP (AbuseIPDB 9% confidence, 9 reports from 6 sources, hosted on Amazon AWS ap-south-1 in India, last reported 2026-09-11, as of 2026-09-19)
File Paths & Utilities:
- /usr/local/sf/bin/package_info.pl – legitimate FMC utility abused with a malicious Makeself license.tmp
- /var/sf/bin/OmniQuery.pl – legitimate query utility abused to dump the user and authentication table
- /var/tmp/license.tmp – malicious Makeself package
- /etc/init.d/ – Cyclops Blink persistence location
- /tmp/f – named pipe used for the Netcat reverse shell
Web Shell Parameter: F6C1F0E7 (Base64-encoded activation parameter for the JSP web shell in the CSM Tomcat web root)
Snort Coverage: SIDs 66075-66080 (CVE-2026-20079), 66883 (CVE-2026-20316), 66960 and 66961 (malware)

Notes: Indicators are current as of the Cisco Talos report (September 9, 2026). Live-status annotations reflect AlienVault OTX, AbuseIPDB, and ransomware.live corroboration on 2026-09-19, a secondary source distinct from the cited report. The command-and-control IPs carrying low abuse scores on clean commercial and cloud hosting underscore why behavioral detection outperforms reputation matching for this activity.

Outbound Connections Initiated by the Firewall Management Appliance

Behavior Targeted: Detects the FMC appliance opening outbound sessions to external or hosting IP space, the shared footprint of the Netcat reverse shells, reverse-SSH tunnels, and Cyclops Blink command-and-control.
MITRE ATT&CK: T1059.004, T1071.004, T1090.001, T1572
Expected Results: Sessions originating from the FMC management interface to public IP space, especially on unusual high ports or matching the campaign indicators.
False Positive Likelihood: LOW
Tuning Guidance: Populate the source list with your FMC management addresses and allowlist Cisco update, licensing, and telemetry destinations; a healthy appliance rarely opens arbitrary outbound sessions.

Splunk SPL Query

index=network (sourcetype="cisco:asa" OR sourcetype="firewall")
    earliest=-30d
    src_ip IN ("10.10.10.5","10.10.10.6")
| where NOT cidrmatch("10.0.0.0/8", dest_ip)
    AND NOT cidrmatch("172.16.0.0/12", dest_ip)
    AND NOT cidrmatch("192.168.0.0/16", dest_ip)
| eval known_ioc=if(dest_ip IN ("89.34.96.56","208.123.119.215","91.214.78.118","104.218.165.253","43.204.2.142"),"yes","no")
| stats count values(dest_ip) AS dst_ips values(dest_port) AS dst_ports values(known_ioc) AS ioc_hit
    min(_time) AS first_seen max(_time) AS last_seen by src_ip
| sort - count
| convert ctime(first_seen) ctime(last_seen)

// TUNING: Replace the src_ip list with your FMC management interface addresses
// TUNING: Allowlist Cisco update / Smart Licensing / telemetry destinations before alerting
// FALSE POSITIVES: Legitimate appliance updates and NTP/DNS; a healthy FMC rarely initiates outbound sessions

Microsoft KQL Query (Defender/Sentinel)

Syslog
| where TimeGenerated > ago(30d)
| where SyslogMessage has_any ("89.34.96.56","208.123.119.215","91.214.78.118","104.218.165.253","43.204.2.142")
| project TimeGenerated, Computer, HostName, ProcessName, SyslogMessage
| order by TimeGenerated desc

// TUNING: Requires the firewall/FMC to forward syslog to Sentinel; adjust to your schema
// TUNING: Stronger still, baseline the FMC management IP and alert on ANY outbound session it initiates to public IP space
// FALSE POSITIVES: Low for IOC hits; validate any appliance-initiated outbound connection

Note: These queries were generated with AI assistance. Test thoroughly in your environment before production use.

Web Shell Drop and Bundled-Utility Abuse on the Appliance

Behavior Targeted: Detects the appliance web server spawning shells, new JSP files in the Tomcat web root, and bundled Perl utilities invoked to dump the user database or unpack the malicious package.
MITRE ATT&CK: T1505.003, T1059.004, T1003
Expected Results: Java or Tomcat processes launching /bin/sh, or OmniQuery.pl and package_info.pl running with database-dump or package-unpack arguments outside a maintenance window.
False Positive Likelihood: LOW
Tuning Guidance: Requires auditd or Sysmon-for-Linux from the FMC forwarded to the SIEM; baseline legitimate use of these utilities during Cisco maintenance.

Splunk SPL Query

index=linux (sourcetype="linux_secure" OR sourcetype="syslog" OR sourcetype="linux_audit")
    earliest=-30d
| search (parent_process="*java*" AND process IN ("sh","bash","/bin/sh"))
    OR command="*OmniQuery.pl*users*"
    OR command="*package_info.pl*license.tmp*"
    OR (command="*mkfifo*" AND command="*/tmp/f*")
| stats count values(command) AS commands min(_time) AS first_seen max(_time) AS last_seen
    by host, user, process
| sort - count
| convert ctime(first_seen) ctime(last_seen)

// TUNING: Requires auditd or Sysmon-for-Linux from the FMC forwarded to Splunk
// TUNING: Baseline legitimate OmniQuery.pl / package_info.pl use during Cisco maintenance windows
// FALSE POSITIVES: Low; these utilities are rarely spawned by the web server or used to read the users table

Microsoft KQL Query (Defender/Sentinel)

Syslog
| where TimeGenerated > ago(30d)
| where SyslogMessage has_any ("OmniQuery.pl","package_info.pl","license.tmp","home.jsp","F6C1F0E7")
    or (SyslogMessage has "mkfifo" and SyslogMessage has "/tmp/f")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc

// TUNING: Requires the FMC to forward auditd/command logging to Sentinel via Syslog
// TUNING: Alert on any web-server process spawning a shell or writing a .jsp into the Tomcat web root
// FALSE POSITIVES: Low; correlate with the source IP that reached the management interface

Note: These queries were generated with AI assistance. Test thoroughly in your environment before production use.

Campaign Command-and-Control Indicator Sweep

Behavior Targeted: Detects any internal host resolving or connecting to the campaign's known scanner and command-and-control addresses, an estate-wide sweep to scope the intrusion.
MITRE ATT&CK: T1190, T1041, T1071.001
Expected Results: Connections or DNS resolutions to the published indicators from the appliance or any pivot host.
False Positive Likelihood: LOW
Tuning Guidance: Extend the IP list from the Cisco Talos GitHub IOC set and widen the lookback to cover the full exposure window of the unpatched appliance.

Splunk SPL Query

index=network (sourcetype="cisco:asa" OR sourcetype="firewall" OR sourcetype="stream:dns")
    earliest=-45d
    dest_ip IN ("89.34.96.56","208.123.119.215","91.214.78.118","104.218.165.253","43.204.2.142")
| stats count values(dest_ip) AS c2 values(dest_port) AS ports
    min(_time) AS first_seen max(_time) AS last_seen by src_ip
| sort - count
| convert ctime(first_seen) ctime(last_seen)

// TUNING: Add new indicators from the Cisco Talos IOC repository as they are published
// TUNING: Widen earliest to cover your full exposure window for the unpatched appliance
// FALSE POSITIVES: Very low for direct IOC hits; any match warrants investigation

Microsoft KQL Query (Defender/Sentinel)

DeviceNetworkEvents
| where Timestamp > ago(45d)
| where RemoteIP in ("89.34.96.56","208.123.119.215","91.214.78.118","104.218.165.253","43.204.2.142")
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, InitiatingProcessCommandLine
| order by Timestamp desc

// TUNING: Add new indicators from the Cisco Talos IOC repository as they publish
// TUNING: Pair with a DNS query hunt for the same infrastructure
// FALSE POSITIVES: Very low; treat any hit as a lead and rotate quickly if confirmed

Note: These queries were generated with AI assistance. Test thoroughly in your environment before production use.

Active Directory Reconnaissance Burst From a Single Host

Behavior Targeted: Detects rapid enumeration of domain accounts, groups, and computer objects from one source, the root-level reconnaissance UAT-11988 runs before lateral movement.
MITRE ATT&CK: T1087.002, T1018
Expected Results: A single account or host touching an unusually large number of directory objects within a short window.
False Positive Likelihood: MEDIUM
Tuning Guidance: Baseline the distinct-object and event thresholds to your domain controllers; vulnerability scanners and identity-governance tools legitimately enumerate AD and should be allowlisted.

Splunk SPL Query

index=windows sourcetype="WinEventLog:Security" (EventCode=4662 OR EventCode=4661)
    earliest=-30d
| bucket _time span=1h
| stats dc(Object_Name) AS distinct_objects count AS access_events by _time, Account_Name, src_ip
| where distinct_objects > 100 OR access_events > 500
| sort - access_events

// TUNING: Adjust the distinct_objects (>100) and access_events (>500) thresholds to your DC baseline
// TUNING: Requires Directory Service Access auditing (SACL) enabled on sensitive AD objects
// FALSE POSITIVES: Scanners, identity governance, and some backup agents enumerate AD; allowlist them

Microsoft KQL Query (Defender/Sentinel)

IdentityQueryEvents
| where Timestamp > ago(30d)
| summarize QueryCount = count(), Queries = make_set(QueryTarget, 50)
    by AccountName, DeviceName, bin(Timestamp, 1h)
| where QueryCount > 200
| order by QueryCount desc

// TUNING: Tune the QueryCount (>200/hour) threshold to your environment's baseline
// TUNING: Prioritize bursts from servers and appliances that have no reason to enumerate AD
// FALSE POSITIVES: Legitimate directory tools and security scanners; allowlist known sources

Note: These queries were generated with AI assistance. Test thoroughly in your environment before production use.

Pass-the-Hash Lateral Movement and Security-Tool Tampering

Behavior Targeted: Detects network logons consistent with pass-the-hash tooling such as Impacket and Invoke-TheHash, where one account or source reaches many hosts before ransomware staging.
MITRE ATT&CK: T1550.002, T1021.002, T1562.001
Expected Results: A single account or source address authenticating over network logons to numerous systems in a short window, often followed by service creation or disabling of security agents.
False Positive Likelihood: MEDIUM
Tuning Guidance: A network NTLM logon with a key length of zero is a common pass-the-hash signature; tune the fan-out threshold and baseline legitimate service accounts.

Splunk SPL Query

index=windows sourcetype="WinEventLog:Security" EventCode=4624 Logon_Type=3
    Authentication_Package=NTLM Key_Length=0
    earliest=-30d
    NOT (Account_Name="ANONYMOUS LOGON")
| stats dc(ComputerName) AS hosts_reached count AS logons values(ComputerName) AS targets
    min(_time) AS first_seen max(_time) AS last_seen by Account_Name, src_ip
| where hosts_reached > 3
| sort - hosts_reached
| convert ctime(first_seen) ctime(last_seen)

// TUNING: LogonType 3 + NTLM + Key_Length 0 is a common pass-the-hash signature; tune hosts_reached (>3)
// TUNING: Correlate with Event 7045 (service creation) and defense-evasion of security agents on the same targets
// FALSE POSITIVES: Some legacy apps and scanners use NTLM; baseline normal service accounts

Microsoft KQL Query (Defender/Sentinel)

DeviceLogonEvents
| where Timestamp > ago(30d)
| where LogonType == "Network" and ActionType == "LogonSuccess"
| summarize HostsReached = dcount(DeviceName), Logons = count(), Targets = make_set(DeviceName, 50),
    FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by AccountName, RemoteIP
| where HostsReached > 3
| order by HostsReached desc

// TUNING: A single account/source reaching many hosts over network logons is the pass-the-hash pattern; tune HostsReached (>3)
// TUNING: Confirm NTLM in SecurityEvent 4624 (Key Length 0), and join DeviceProcessEvents for Impacket wmiexec/smbexec and DeviceEvents for AV/EDR tampering
// FALSE POSITIVES: Scanners and admin tools generate network logons; baseline and allowlist service accounts

Note: These queries were generated with AI assistance. Test thoroughly in your environment before production use.

Back to Hunting off the Red