Detectionlowtest

Cisco Stage Data

Various protocols maybe used to put data on the device for exfil or infil

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Austin ClarkCreated Mon Aug 12Updated Wed Jan 045e51acb2-bcbe-435b-99c6-0e3cd5e2aa59network

Log Source

Ciscoaaa

ProductCisco← raw: cisco

Serviceaaa← raw: aaa

Detection Logic

detection:
    keywords:
        - 'tftp'
        - 'rcp'
        - 'puts'
        - 'copy'
        - 'configure replace'
        - 'archive tar'
    condition: keywords

False Positives

Generally used to copy configs or IOS images

MITRE ATT&CK

Tactics

TA0009 · Collection TA0008 · Lateral Movement TA0011 · Command and Control TA0010 · Exfiltration

Techniques

T1074 · Data Staged T1105 · Ingress Tool Transfer

Sub-techniques

T1560.001 · Archive via Utility

Rule Metadata

Rule ID

5e51acb2-bcbe-435b-99c6-0e3cd5e2aa59

Status

test

Level

low

Type

Detection

Created

Mon Aug 12

Modified

Wed Jan 04

Author

Austin Clark

Path

rules/network/cisco/aaa/cisco_cli_moving_data.yml

Raw Tags

attack.collectionattack.lateral-movementattack.command-and-controlattack.exfiltrationattack.t1074attack.t1105attack.t1560.001

View on GitHub