cisco Sigma detection rules

Clear command history in network OS which is used for defense evasion

cisco · aaa

Show when private keys are being exported from the device, or when new certificates are installed

cisco · aaa

Turn off logging locally or remote

cisco · aaa

Find local accounts being created or modified as well as remote authentication configurations

cisco · aaa

Detecting exploitation indicators of CVE-2023-20198 a privilege escalation vulnerability in Cisco IOS XE Software Web UI.

cisco · syslog

Detect a system being shutdown or put into different boot mode

cisco · aaa

Detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface. Disabling dot1x bypasses Network Access Control (NAC) mechanisms, potentially allowing unauthorized devices to gain access to the internal network. This activity is a common technique used by attackers or malicious insiders to establish persistence or perform lateral movement via rogue devices.

cisco · aaa

Detects when a successful MFA authentication occurs due to the use of a bypass code. A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as "backup codes," so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can't use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems.

cisco · duo

See what files are being deleted from flash file systems

cisco · aaa

Modifications to a config that will serve an adversary's impacts or persistence

cisco · aaa

See what commands are being input into the device by other people, full credentials can be in the history

cisco · aaa

Show when a monitor or a span/rspan is setup or modified

cisco · aaa

Detects BGP failures which may be indicative of brute force attacks to manipulate routing

cisco · bgp

Collect pertinent data from the configuration files

cisco · aaa

Find information about network devices that is not stored in config files

cisco · aaa

Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

cisco · ldp

Various protocols maybe used to put data on the device for exfil or infil

cisco · aaa