Detectionhightest

Cisco Disabling Logging

Turn off logging locally or remote

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Austin ClarkCreated Sun Aug 11Updated Wed Jan 049e8f6035-88bf-4a63-96b6-b17c0508257enetwork

Log Source

Ciscoaaa

ProductCisco← raw: cisco

Serviceaaa← raw: aaa

Detection Logic

detection:
    keywords:
        - 'no logging'
        - 'no aaa new-model'
    condition: keywords

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

9e8f6035-88bf-4a63-96b6-b17c0508257e

Status

test

Level

high

Type

Detection

Created

Sun Aug 11

Modified

Wed Jan 04

Author

Path

rules/network/cisco/aaa/cisco_cli_disable_logging.yml

Raw Tags

attack.defense-evasionattack.t1562.001