# ThreatHunter.ai Detection Pack
# Reference: CISA AR26-113A "FIRESTARTER Backdoor" Malware Analysis Report
# Joint: CISA + NCSC-UK, with Cisco contribution
# Published: 23 April 2026
# Pack version: 1.0.0
# Maintainer: ThreatHunter.ai Detection Engineering (Argillite)
# Classification: TLP:CLEAR (pack metadata); IOCs per CISA release
#
# Scope and honest caveat:
# FIRESTARTER runs on Cisco ASA/FTD. LINE VIPER, which it pairs with, actively
# hooks syslog, suppresses specific message IDs, intercepts CLI commands, and
# can intentionally crash the device to defeat forensics. CISA states in the
# MAR that Sigma rules do not offer effective detection of FIRESTARTER itself
# because the malware does not generate observable log events or behavioral
# anomalies in standard monitoring platforms.
#
# The authoritative detection is CISA's YARA rules applied to a core dump or
# disk image of the device. Those rules are reproduced verbatim in this pack.
#
# The behavioral rules below therefore target what defenders CAN still see:
#   - Pre-implant exploitation of CVE-2025-20333 / CVE-2025-20362
#   - Valid-accounts abuse for illegitimate VPN sessions (former employees)
#   - Gaps in logging, unexpected reboots, integrity-check anomalies
#   - WebVPN request patterns consistent with LINE VIPER C2 triggers
#   - Upstream NetFlow and syslog from adjacent devices the implant cannot mute
#   - Posture and hygiene conditions that enable or extend this campaign
#
# If the device is already implanted, the YARA-on-core-dump workflow is the
# only reliable detection. Plan accordingly.

metadata:
  pack_id: TH-DP-AR26-113A
  pack_name: FIRESTARTER Backdoor (Cisco ASA/FTD)
  pack_version: 1.0.0
  published: 2026-04-23
  advisory_refs:
    - CISA AR26-113A MAR FIRESTARTER (2026-04-23)
    - CISA ED 25-03 V1 (2025-09-25, updated 2026-04-23)
    - CISA Supplemental Direction ED 25-03 (Core Dump and Hunt Instructions)
    - NCSC-UK MAR RayInitiator and LINE VIPER (2025-09-25)
    - Cisco Event Response: Continued Attacks Against Cisco ASA/FTD
    - Cisco Talos ArcaneDoor (updated 2026-03-10)
  threat_actors:
    - UAT4356 (Talos)
    - Storm-1849 (MSTIC)
    - ArcaneDoor campaign
  related_malware:
    - LINE VIPER (user-mode shellcode loader)
    - RayInitiator (GRUB bootkit)
    - Line Dancer (prior campaign)
    - Line Runner (prior campaign)
  affected_products:
    - Cisco Adaptive Security Appliance (ASA)
    - Cisco Firepower Threat Defense (FTD)
    - Cisco Secure Firewall (Firepower-series hardware)
    - Focus: ASA 5500-X series running vulnerable ASA software
  cves:
    - CVE-2025-20333  # Improper input validation, authenticated RCE as root
    - CVE-2025-20362  # Missing authorization / unauthorized URL endpoint access
    - CVE-2025-20363  # Additional, patched with the same cycle
  mitre_attack_techniques:
    - T1190  # Exploit Public-Facing Application
    - T1059  # Command and Scripting Interpreter
    - T1543  # Create or Modify System Process
    - T1546.004  # Event Triggered Execution: Unix Shell Configuration Modification
    - T1547  # Boot or Logon Autostart Execution
    - T1133  # External Remote Services
    - T1078  # Valid Accounts
    - T1222  # File and Directory Permissions Modification
    - T1564  # Hide Artifacts
    - T1070.004  # Indicator Removal: File Deletion
    - T1070.006  # Indicator Removal: Timestomp
    - T1036.005  # Masquerading: Match Legitimate Resource Name or Location
    - T1055  # Process Injection
    - T1057  # Process Discovery
    - T1082  # System Information Discovery
    - T1219  # Remote Access Tools
  detection_philosophy: |
    Detect early, detect adjacent, and verify on a core dump.
    Early = pre-implant exploitation and auth anomalies in SIEM before the
    device goes dark.
    Adjacent = flows, syslog, and NetFlow from upstream switches, upstream
    routers, and identity providers, which the implant cannot silence.
    Verify = CISA YARA against a core dump or disk image from the device.

# -----------------------------------------------------------------------------
# Section 1: CISA-published YARA rules (reproduced verbatim from AR26-113A)
# -----------------------------------------------------------------------------
yara_rules:
  - id: TH-YR-AR26-113A-01
    name: CISA_261290_01
    source: CISA AR26-113A
    apply_to: [core_dump, disk_image]
    rule: |
      rule CISA_261290_01 : FIRESTARTER backdoor captures_system_state_data cleans_traces_of_infection fingerprints_host persists_after_system_reboot
      {
        meta:
            author = "CISA Code & Media Analysis"
            incident = "261290"
            date = "2026-4-3"
            last_modified = "20260406_732"
            actor = "n/a"
            family = "n/a"
            capabilities = "captures-system-state-data cleans-traces-of-infection fingerprints-host persists-after-system-reboot"
            malware_type = "backdoor"
            tool_type = "unknown"
            description = "Detects CISCO Firepower FIRESTARTER injector samples"
        strings:
             $s1 = { 57 48 C1 EF 0C 48 C1 E7 0C BA 07 00 00 00 48 C7 C6 00 20 00 00 }
             $s2 = { 2f 6f 70 74 2f 63 69 73 63 6f 2f 70 6c 61 74 66 6f 72 6d 2f 6c 6f 67 73 2f 76 61 72 2f 6c 6f 67 2f }
             $s3 = { 2f 6f 70 74 2f 63 69 73 63 6f 2f 63 6f 6e 66 69 67 2f 70 6c 61 74 66 6f 72 6d 2f 72 6d 64 62 2f }
             $s4 = { 2f 76 61 72 2f 72 75 6e 2f 72 75 6e 6c 65 76 65 6c}
             $s5 = { 2f 70 72 6f 63 2f 25 73 2f 63 6f 6d 6d }
             $s6 = { 2f 70 72 6f 63 2f 25 64 2f 6d 61 70 73 }
             $s7 = { 2f 61 73 61 2f 62 69 6e 2f 6c 69 6e 61 }
        condition:
             5 of them
      }

  - id: TH-YR-AR26-113A-02
    name: CISA_261290_02
    source: CISA AR26-113A
    apply_to: [core_dump, disk_image, memory_segment]
    rule: |
      rule CISA_261290_02 : FIRESTARTER_shellcode backdoor captures_system_state_data cleans_traces_of_infection fingerprints_host persists_after_system_reboot
      {
         meta:
            author = "CISA Code & Media Analysis"
            incident = "261290"
            date = "2026-4-3"
            last_modified = "20260406_732"
            actor = "n/a"
            family = "n/a"
            capabilities = "captures-system-state-data cleans-traces-of-infection fingerprints-host persists-after-system-reboot"
            malware_type = "backdoor"
            tool_type = "unknownk"
            description = "Detects CISCO Firepower FIRESTARTER_shellcode samples"
         strings:
             $1 = { 57 4C 8B 47 18 4D 85 C0 0F 84 C7 01 00 00 49 8B 38 48 85 FF }
             $2 = { 48 83 C6 08 4C 39 C6 0F 87 7A 01 00 00 4C 8B 0E }
             $3 = { 48 89 D7 4C 89 CE B9 D0 01 00 F3 A4 48 89 D7 57 48 C1 EF 0C 48 C1 E7 0C }
             $4 = { 0F 05 58 5F FF E0 90 90 }
         condition:
             3 of them
      }

# -----------------------------------------------------------------------------
# Section 2: Pre-implant exploitation signals
# -----------------------------------------------------------------------------
rules:

  - id: TH-FS-001
    title: Exploitation attempt against CVE-2025-20362 on Cisco ASA/FTD VPN web server
    severity: critical
    confidence: high
    description: |
      CVE-2025-20362 permits unauthenticated access to restricted URL endpoints
      on the VPN web server. Exploitation shows up as anomalous HTTP requests
      to WebVPN/AnyConnect endpoints that should require auth. Upstream proxies
      and load balancers log this traffic; the ASA itself may not if the
      request succeeds.
    data_sources:
      - upstream_proxy_access_log
      - load_balancer_log
      - network_ids_snort
    logic:
      type: filter
      detection: |
        dst.device_role = "asa_ftd"
        AND dst.port IN (443, 8443)
        AND (
          http.uri MATCHES "(?i)/(\\+CSCOE\\+|\\+CSCOU\\+|webvpn|sslvpn)/.*"
          AND http.status IN (200, 302)
          AND http.auth_header_present = false
        )
    ids_coverage:
      snort: [65340, 46897]
    mitre: [T1190]
    response:
      - preserve_asa_core_dump
      - notify_on_call
      - restrict_mgmt_access_to_admin_vlan

  - id: TH-FS-002
    title: ASA/FTD VPN web server receiving exploit-shaped POST to host-scan-reply
    severity: critical
    confidence: high
    description: |
      Historic ArcaneDoor tradecraft used the host-scan-reply field to inject
      shellcode. LINE VIPER derivatives reuse WebVPN request elements to
      trigger handler detours. Look for oversized, repeated, or malformed
      POSTs to AnyConnect endpoints, especially carrying form elements with
      non-printable or anomalous content.
    data_sources:
      - upstream_proxy_access_log
      - zeek
      - vizium
    logic:
      type: filter
      detection: |
        dst.device_role = "asa_ftd"
        AND http.method = "POST"
        AND http.uri MATCHES "(?i)/(\\+CSCOE\\+|\\+CSCOU\\+|webvpn).*"
        AND (
          http.body_bytes > 8192
          OR http.body.printable_ratio < 0.7
          OR http.body.contains("host-scan-reply")
          OR http.body.contains("group-select")
        )
    mitre: [T1190, T1059]

  - id: TH-FS-003
    title: Sustained reconnaissance against ASA/FTD WebVPN from a single source
    severity: high
    confidence: medium
    description: |
      Pre-exploit recon for the ArcaneDoor cluster has been observed as
      persistent, low-volume probing of /+CSCOE+/ and related endpoints. A
      single source hitting the same ASA's WebVPN path more than a handful
      of times in a day with no successful auth is a hunt lead.
    data_sources:
      - upstream_proxy_access_log
      - zeek
    logic:
      type: aggregation
      window: 24h
      detection: |
        COUNT(*) BY src.ip, dst.device WHERE
          dst.device_role = "asa_ftd"
          AND http.uri MATCHES "(?i)/(\\+CSCOE\\+|\\+CSCOU\\+|webvpn|sslvpn)/.*"
          AND http.auth_result != "success"
        HAVING COUNT >= 20
    mitre: [T1595]

# -----------------------------------------------------------------------------
# Section 3: Identity signals tied to LINE VIPER handoff
# -----------------------------------------------------------------------------

  - id: TH-FS-010
    title: Successful VPN authentication using a disabled or former employee account
    severity: critical
    confidence: high
    description: |
      In the observed FIRESTARTER incident, APT actors used LINE VIPER to
      establish illegitimate VPN sessions tied to accounts that existed but
      were no longer active. Any successful VPN auth tied to an account in
      disabled, suspended, termed, or leaver state is an urgent finding.
    data_sources:
      - vpn_auth
      - entra_signin
      - ad_user_state
      - hr_leaver_feed
    logic:
      type: filter
      detection: |
        event = "vpn_auth_success"
        AND (
          user.ad_state IN ("disabled","suspended","expired")
          OR user.hr_status IN ("terminated","resigned","leaver")
          OR user.last_interactive_login_days_ago > 180
        )
    mitre: [T1078, T1133]
    response:
      - session_revoke
      - lock_account
      - preserve_asa_core_dump

  - id: TH-FS-011
    title: VPN session established that bypasses AAA logging
    severity: high
    confidence: medium
    description: |
      LINE VIPER is capable of bypassing AAA for actor-selected devices and
      hiding specific session IDs from syslog. Symptom is a VPN session that
      shows up in NetFlow or firewall state tables but has no corresponding
      AAA accounting or syslog record. Detect by reconciling flow state to
      auth events.
    data_sources:
      - netflow
      - vpn_auth
      - radius_tacacs_accounting
    logic:
      type: reconciliation
      window: 1h
      detection: |
        FOR session IN netflow WHERE
          src.device_role = "asa_ftd_vpn"
          AND session.type = "ssl_vpn_tunnel"
        ASSERT EXISTS auth_event WHERE
          auth_event.src_ip = session.assigned_ip
          AND auth_event.time BETWEEN session.start - 5m AND session.start + 1m
        ALERT IF NOT EXISTS
    mitre: [T1562.002, T1070]

  - id: TH-FS-012
    title: AAA server reports VPN auth with no matching NAS accounting record
    severity: high
    confidence: medium
    description: |
      A mirror of TH-FS-011 from the AAA side. RADIUS Access-Accept without a
      follow-up Accounting-Start within the expected window can indicate the
      ASA is dropping or suppressing the accounting record after the implant
      selectively hooks AAA.
    data_sources:
      - radius_tacacs_accounting
    logic:
      type: sequence
      window: 5m
      detection: |
        EVENT A: code = "Access-Accept" AND service = "vpn"
        NOT FOLLOWED BY
        EVENT B: code = "Accounting-Start" AND user = A.user AND nas = A.nas
    mitre: [T1562.002]

# -----------------------------------------------------------------------------
# Section 4: Device integrity and logging anomalies
# -----------------------------------------------------------------------------

  - id: TH-FS-020
    title: Unexpected reboot of a Cisco ASA or FTD device
    severity: high
    confidence: medium
    description: |
      LINE VIPER derivatives intentionally crash devices to frustrate
      forensic recovery. Any unscheduled reboot of an ASA or FTD should
      preserve volatile artifacts (core dump, show tech-support detail)
      before any patch, reboot, or config change.
    data_sources:
      - syslog_network
      - snmp_trap
    logic:
      type: filter
      detection: |
        device.role IN ("asa","ftd","firepower")
        AND (
          syslog.id IN ("%ASA-1-104002","%ASA-6-199002","%ASA-2-106001")
          OR syslog.message MATCHES "(?i)(reload|crash|assertion failed|watchdog)"
        )
        AND scheduled_maintenance = false
    mitre: [T1070, T1499]
    response:
      - preserve_asa_core_dump
      - freeze_patching_pending_triage

  - id: TH-FS-021
    title: Gap in ASA or FTD syslog relative to baseline volume
    severity: medium
    confidence: medium
    description: |
      Logging suppression is a known LINE VIPER behavior. A sudden drop in
      syslog volume from an ASA or FTD, out of proportion to traffic through
      the device, is a leading indicator.
    data_sources:
      - syslog_volume_metrics
      - netflow_volume_metrics
    logic:
      type: statistical
      detection: |
        device.role IN ("asa","ftd","firepower")
        AND syslog.msgs_per_minute < 0.3 * baseline_msgs_per_minute[device, weekday, hour]
        AND netflow.bytes_per_minute >= 0.5 * baseline_bytes_per_minute[device, weekday, hour]
    mitre: [T1562.002, T1564]

  - id: TH-FS-022
    title: show checkheaps / show tech-support detail output shows anomalies
    severity: high
    confidence: high
    type: periodic_hunt
    description: |
      CISA supplemental direction for ED 25-03 directs admins to run
      show checkheaps and show tech-support detail and save the output off
      the device. Parse the output for known-bad indicators: extra executable
      memory regions in lina, particularly any region exactly 0x1000 bytes,
      suspicious processes, or broken integrity checks.
    data_sources:
      - asset_inventory
      - network_mgmt_automation
    logic:
      type: scheduled_hunt
      schedule: daily
      detection: |
        parse(show_memory_region) WHERE process = "lina"
          AND executable_region_count > 1
        OR
        parse(show_memory_region) WHERE process = "lina"
          AND any_region.size == 0x1000
        OR
        parse(show_checkheaps) WHERE status != "pass"
    mitre: [T1055]

# -----------------------------------------------------------------------------
# Section 5: Post-compromise re-access patterns
# -----------------------------------------------------------------------------

  - id: TH-FS-030
    title: Reappearance of LINE VIPER C2 triggers after device patch
    severity: critical
    confidence: high
    description: |
      FIRESTARTER exists specifically to regain access without re-exploiting
      the CVE. Watch for WebVPN requests that re-trigger the same element
      handler detour after the device has been patched. Pattern: repeated
      POST to group-select XML element on a patched ASA, from an external
      source that previously probed the device.
    data_sources:
      - upstream_proxy_access_log
      - zeek
      - vizium
    logic:
      type: sequence
      window: 30d
      detection: |
        EVENT A: device.patched_cve IN ("CVE-2025-20333","CVE-2025-20362")
                 AND event = "patch_applied"
        FOLLOWED BY
        EVENT B: http.body.contains("group-select")
                 AND http.method = "POST"
                 AND dst.device = A.device
                 AND src.ip NOT IN (approved_mgmt_sources)
    mitre: [T1219, T1133]
    response:
      - isolate_device_for_core_dump
      - escalate_to_ir

  - id: TH-FS-031
    title: ICMP tunneling to or from an ASA/FTD device
    severity: high
    confidence: medium
    description: |
      LINE VIPER can receive commands over WebVPN and return data over raw
      TCP, but related tooling (RayInitiator stages) has used ICMP with raw
      TCP responses. Any sustained ICMP volume to or from an ASA/FTD device
      beyond baseline monitoring is worth a hunt.
    data_sources:
      - netflow
      - vizium
    logic:
      type: statistical
      detection: |
        (src.device_role = "asa_ftd" OR dst.device_role = "asa_ftd")
        AND protocol = "icmp"
        AND (
          packets_per_hour > 5000
          OR unique_peers_per_hour > 20
          OR max_payload_size > 1000
        )
    mitre: [T1095, T1572]

# -----------------------------------------------------------------------------
# Section 6: Posture hunts (configuration and hygiene)
# -----------------------------------------------------------------------------

  - id: TH-FS-050
    title: ASA/FTD device missing patches for CVE-2025-20333 or CVE-2025-20362
    severity: critical
    confidence: high
    type: posture_hunt
    description: |
      Any unpatched ASA or FTD device is an open door to this campaign and
      to FIRESTARTER persistence. TACT-IO should flag these continuously
      and generate a remediation ticket.
    data_sources:
      - tactio
      - asset_inventory
    logic:
      type: config_audit
      detection: |
        device.product IN ("cisco_asa","cisco_ftd","cisco_secure_firewall")
        AND (
          device.software_version.vulnerable_to("CVE-2025-20333")
          OR device.software_version.vulnerable_to("CVE-2025-20362")
        )
    response:
      - generate_remediation_ticket_p0
      - notify_customer_executive_sponsor

  - id: TH-FS-051
    title: ASA 5500-X series without secure boot support still internet-exposed
    severity: critical
    confidence: high
    type: posture_hunt
    description: |
      RayInitiator specifically targets ASA 5500-X devices that do not have
      secure boot. Those devices can carry a persistent bootkit even after a
      clean software reinstall. Identify them and take them off the internet.
    data_sources:
      - asset_inventory
      - tactio
    logic:
      type: config_audit
      detection: |
        device.product = "cisco_asa"
        AND device.model MATCHES "ASA55[0-9]{2}-X"
        AND device.secure_boot != "enabled"
        AND device.exposure = "internet"
    response:
      - recommend_replacement
      - recommend_isolation

  - id: TH-FS-052
    title: Privileged ASA/FTD accounts without recent credential rotation
    severity: medium
    confidence: high
    type: posture_hunt
    description: |
      Mitigation guidance in AR26-113A recommends regular rotation of
      privileged and service account credentials on network devices. Flag
      privileged device accounts that have not been rotated in over 90 days.
    data_sources:
      - network_device_aaa
      - tacacs_accounting
    logic:
      type: config_audit
      detection: |
        account.role IN ("level_15","priv_exec","enable","service")
        AND device.role IN ("asa","ftd")
        AND account.days_since_password_change > 90

  - id: TH-FS-053
    title: TACACS+ in use without TLS 1.3 session encryption
    severity: medium
    confidence: high
    type: posture_hunt
    description: |
      AR26-113A specifically calls out modernizing TACACS+ over TLS 1.3 as a
      hardening step. Legacy TACACS+ uses a shared-secret obfuscation that
      is trivial to strip off-path. Report legacy TACACS+ deployments.
    data_sources:
      - network_device_config
    logic:
      type: config_audit
      detection: |
        tacacs.enabled = true
        AND tacacs.transport != "tls"
    response:
      - recommend_tacacs_tls_upgrade

  - id: TH-FS-054
    title: Stale or dormant user accounts retaining VPN entitlement
    severity: high
    confidence: high
    type: posture_hunt
    description: |
      The specific identity abuse pattern in the AR26-113A incident was
      former employees whose accounts still existed. Identify and report any
      account with VPN entitlement whose owner has been disabled in AD, left
      the company per HR feed, or has not authenticated interactively in 90
      or more days.
    data_sources:
      - entra_signin
      - ad_user_state
      - hr_leaver_feed
      - vpn_entitlement_group
    logic:
      type: join
      detection: |
        account IN vpn_entitlement_group
        AND (
          account.ad_state IN ("disabled","suspended")
          OR account.hr_status IN ("terminated","resigned")
          OR account.last_interactive_login_days_ago > 90
        )
    response:
      - revoke_vpn_entitlement
      - open_identity_hygiene_ticket

# -----------------------------------------------------------------------------
# Section 7: Response playbook hooks
# -----------------------------------------------------------------------------
response_actions:
  preserve_asa_core_dump: |
    Before any reboot, patch, or config change, per CISA Supplemental
    Direction ED 25-03:
      1. Run "show checkheaps" and save full output off the device.
      2. Run "show tech-support detail" and save full output off the device.
      3. Generate a core dump via the Cisco-documented procedure.
      4. Submit the core dump to CISA Malware Next Generation platform.
      5. Apply CISA YARA rules TH-YR-AR26-113A-01 and -02 to the dump.
      6. Report to CISA 24/7 Ops (1-844-729-2472) or NCSC as applicable.
      7. Do NOT hard power-cycle or reboot without CISA direction if the
         device is an FCEB asset.
  isolate_device_for_core_dump: |
    Non-FCEB path:
      1. Move device mgmt access behind an admin VLAN.
      2. Collect core dump.
      3. If YARA matches, confirm with CISA or NCSC.
      4. Only then, physically remove power (all power sources, including
         redundant supplies) for a minimum of 60 seconds.
      5. Reconnect and rebuild on a patched baseline on hardware that
         supports secure boot.
  session_revoke: POST /milbert/api/v1/sessions/revoke
  lock_account: POST /milbert/api/v1/accounts/lock
  generate_remediation_ticket_p0: POST /argos/api/v1/tickets?priority=P0
  restrict_mgmt_access_to_admin_vlan: POST /argos/api/v1/change-requests
  freeze_patching_pending_triage: POST /argos/api/v1/change-freeze

# -----------------------------------------------------------------------------
# Deployment notes
# -----------------------------------------------------------------------------
deployment:
  priority_order:
    - Deploy YARA rules TH-YR-AR26-113A-01 and -02 against any collected core
      dumps immediately
    - Run posture hunts TH-FS-050 through TH-FS-054 within 24 hours and
      generate remediation tickets for any findings
    - Enable pre-implant rules TH-FS-001 through TH-FS-003 at the upstream
      proxy or IPS layer; do not rely on the ASA itself to log this
    - Enable identity rules TH-FS-010 through TH-FS-012 after a 7 day
      baseline window
    - Enable integrity rules TH-FS-020 through TH-FS-022 and schedule
      TH-FS-022 as a daily hunt
  operational_notes: |
    - Do not trust syslog from a potentially compromised ASA. Cross-reference
      with upstream switch, router, and IDS telemetry.
    - If AR26-113A indicates your device is compromised, patching alone does
      NOT remove FIRESTARTER. Only a full power disconnect, directed by CISA
      or NCSC, followed by a rebuild, will clear the persistence path.
    - Core dumps and show-command output must be captured BEFORE any
      remediation action that could destroy volatile state.
  minimum_retention_days: 180
  recommended_retention_days: 365
