Detections

Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware

Cisco FMC Web Interface Authentication Bypass Attempt

sigma · generated; parse required before publication

title: Cisco FMC Web Interface Authentication Bypass Attempt
description: Detects HTTP requests attempting unauthenticated exploitation of Cisco Secure Firewall Management Center (CVE-2026-20079).
logsource:
  product: cisco
  category: web_access
detection:
  selection:
    cs-method: POST
    cs-uri-stem: "*fmc*auth*bypass*"
  condition: selection
level: critical
tags:
  - attack.initial_access
  - attack.t1190
references:
  - https://thehackernews.com/2026/09/cisco-fmc-flaws-exploited-to-steal.html

Qilin_Ransomware_Note_Artifact

yara · compile required before publication

rule Qilin_Ransomware_Note_Artifact {
  strings:
    $s1 = "QILIN RESTORATION INSTRUCTIONS" ascii wide nocase
    $s2 = "All your files have been encrypted by Qilin" ascii wide nocase
    $s3 = "qilin_support" ascii wide
  condition:
    any of them
}