CVE-2026-20131 — Interlock Ransomware Exploiting Cisco Secure Firewall Management Center RCE

Looks for: unauthenticated POST requests to FMC web-management endpoints carrying serialized-object-style payloads (Java rO0 base64 marker, large bodies, odd content types). ⚠ field names parser-dependent

// HUNT: Anomalous deserialization-style POST to the Cisco FMC web UI (CVE-2026-20131)
// MITRE: T1190 | CONF: medium  FP: medium  COST: low
// REQUIRES: Cisco FMC web/admin/HTTP logs ingested into LogScale/NG-SIEM
// FALSE POSITIVES: legitimate large admin POSTs / API automation
// TUNING: scope to the FMC mgmt VIP; baseline known API clients; alert on unauth + rO0 marker
vendor=/cisco/i product=/Firewall Management Center|FMC/i
| http_method="POST"
| url=/\/(api|admin|ui|webui)\//i
| (request_body=/rO0[AB]/ OR content_type=/application\/x-java-serialized-object/i OR body_len > 50000)
| auth_status=/fail|none|anonymous/i
| table([@timestamp, src_ip, http_method, url, content_type, body_len, user_agent], limit=200)
| sort(@timestamp, order=desc)

Looks for: shell / network-tool execution as root on the FMC host correlated to the web service — the post-deserialization payload. ⚠ field names parser-dependent

// HUNT: Root shell / outbound tooling on the FMC appliance after web-UI activity
// MITRE: T1190, T1059 | CONF: medium  FP: low-med  COST: low
// REQUIRES: FMC OS/syslog (auth, process, or audit) ingested
// FALSE POSITIVES: sanctioned maintenance windows / Cisco TAC sessions
// TUNING: allow-list scheduled maintenance; alert on shells parented by the web/Java service
vendor=/cisco/i host=/fmc/i
| user=/root/i
| process=/(bash|sh|curl|wget|nc|ncat|python|perl)$/i
| parent_process=/(java|tomcat|httpd|nginx|mojo)/i
| table([@timestamp, host, user, process, parent_process, cmdline], limit=200)
| sort(@timestamp, order=desc)

Looks for: ScreenConnect / common RMM binaries executing on internal hosts. FP: sanctioned IT RMM — allow-list your approved tool and management hosts.

// HUNT: Unsanctioned RMM / remote-access software (Interlock hands-on access)
// MITRE: T1219 | CONF: high  FP: medium  COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: the org's sanctioned RMM tool / IT admin hosts
// TUNING: allow-list the approved RMM product + its deployment hosts; alert on the rest
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(ScreenConnect|Connectwisechat|AnyDesk|atera|splashtop|ScreenConnect\.ClientService|ScreenConnect\.WindowsClient)\.exe$/i
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, SHA256HashData], limit=200)
| sort(@timestamp, order=desc)

Looks for: offensive AD-CS tooling (Certify) and memory-forensics (Volatility) on production hosts, plus their tell-tale command-line verbs. FP: sanctioned red-team / IR — allow-list.

// HUNT: Certify / Volatility credential & certificate-theft tooling on production hosts
// MITRE: T1649, T1003 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: sanctioned red-team / IR engagements — allow-list operator hosts/AIDs
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| (FileName=/^(Certify|vol|volatility|volatility3)\.exe$/i
   OR CommandLine=/certify\s+(find|request|enroll)|--vulnerable|windows\.pslist|windows\.lsadump/i)
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, SHA256HashData], limit=200)
| sort(@timestamp, order=desc)

Looks for: shadow-copy, backup-catalog and boot-recovery deletion — the Interlock pre-encryption step. Accomplishes: high-fidelity ransomware staging detection independent of the FMC entry path.

// HUNT: Volume shadow / backup / recovery deletion ahead of encryption (Interlock kill-chain)
// MITRE: T1490 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 command-line telemetry
// FALSE POSITIVES: sanctioned backup maintenance — allow-list backup service accounts
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(vssadmin|wmic|bcdedit|wbadmin|powershell|cmd)\.exe$/i
| CommandLine=/(delete\s+shadows|shadowcopy\s+delete|resize\s+shadowstorage|deletecatalog|recoveryenabled\s+no|bootstatuspolicy\s+ignoreallfailures)/i
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName], limit=200)
| sort(@timestamp, order=desc)

Looks for: one process touching an abnormally high number of distinct files in a short window — the encryption burst. FP: backup/indexing/AV — allow-list. Pair with Q5 on the same host for confidence.

// HUNT: Single process performing high-volume file modification (ransomware encryption burst)
// MITRE: T1486 | CONF: medium  FP: medium  COST: medium
// REQUIRES: FileCreateInfo / file-write telemetry with writing-process context
// FALSE POSITIVES: backup agents, search indexers, AV — allow-list by process
// TUNING: tune the threshold to your environment; correlate with Q5 hits on same aid
#event_simpleName=/PeFileWritten/
| FileName!=/^(Backup|SearchIndexer|CSFalconService|MsMpEng)\.exe$/i
| groupBy([aid, ContextProcessId, ContextBaseFileName], function=([
    count(TargetFileName, distinct=true, as=filesTouched),
    min(@timestamp, as=t0), max(@timestamp, as=t1)
  ]))
| filesTouched >= 200
| sort(filesTouched, order=desc)