Revamp Cisco FTD and its Dependent Detections - #4328

Summary

This PR mainly contains updates to existing network detections, based on the telemetry from recent engagements. List of changes can be found below.

Changes

Lookups

Detections

Remote access software (detect_remote_access_software_usage_*)

• Covers the file, fileinfo, process, registry, DNS, traffic and URL variants.
• Each builds its pre-filter from inputlookup remote_access_software on the relevant column, then enriches matches with lookup ... OUTPUT app as signature, category, reference, description.
• Alert messages now include the matched software name and, where available, the user.

Cisco Secure Firewall

• Remote Access Software Usage Traffic: matches ClientApplication against remote_access_software.match_pattern. No longer uses cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools or its category filter.
• Connection to File Sharing Domain: uses filesharing_domains_lookup instead of an inline url IN (...) list.
• Communication Over Suspicious Ports: replaces the fixed list of 10 ports with a pattern-based check on ports 1025-49150. It flags repeated digits (4444, 55555), ascending digits (1234, 12345) and descending digits (4321).

HTTP POST Request with Encoded Payload (Zeek)

• Now also detects URL, XML, Unicode and Octal encodings, in addition to hex and base64.
• Excludes application/x-www-form-urlencoded and application/ocsp-request bodies and a few mobile-app user agents.
• uri moved from the by clause into values().