Detectionmediumtest

Cisco File Deletion

See what files are being deleted from flash file systems

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Austin ClarkCreated Mon Aug 12Updated Wed Jan 0471d65515-c436-43c0-841b-236b1f32c21enetwork

Log Source

Ciscoaaa

ProductCisco← raw: cisco

Serviceaaa← raw: aaa

Detection Logic

detection:
    keywords:
        - 'erase'
        - 'delete'
        - 'format'
    condition: keywords

False Positives

Will be used sometimes by admins to clean up local flash space

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

71d65515-c436-43c0-841b-236b1f32c21e

Status

test

Level

medium

Type

Detection

Created

Mon Aug 12

Modified

Wed Jan 04

Author

Path

rules/network/cisco/aaa/cisco_cli_file_deletion.yml

Raw Tags

attack.defense-evasionattack.impactattack.t1070.004attack.t1561.001attack.t1561.002