Detectionmediumtest

Cisco Modify Configuration

Modifications to a config that will serve an adversary's impacts or persistence

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Austin ClarkCreated Mon Aug 12Updated Mon Apr 28671ffc77-50a7-464f-9e3d-9ea2b493b26bnetwork

Log Source

Ciscoaaa

ProductCisco← raw: cisco

Serviceaaa← raw: aaa

Detection Logic

detection:
    keywords:
        - 'ip http server'
        - 'ip https server'
        - 'kron policy-list'
        - 'kron occurrence'
        - 'policy-list'
        - 'access-list'
        - 'ip access-group'
        - 'archive maximum'
        - 'ntp server'
    condition: keywords