Detectionlowtest

Cisco Collect Data

Collect pertinent data from the configuration files

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Austin ClarkCreated Sun Aug 11Updated Wed Jan 04cd072b25-a418-4f98-8ebc-5093fb38fe1anetwork

Log Source

Ciscoaaa

ProductCisco← raw: cisco

Serviceaaa← raw: aaa

Detection Logic

detection:
    keywords:
        - 'show running-config'
        - 'show startup-config'
        - 'show archive config'
        - 'more'
    condition: keywords

False Positives

Commonly run by administrators

References

Resolving title…

blog.router-switch.com

MITRE ATT&CK

Tactics

TA0007 · Discovery TA0006 · Credential Access TA0009 · Collection

Techniques

T1005 · Data from Local System

Sub-techniques

T1087.001 · Local Account T1552.001 · Credentials In Files

Rule Metadata

Rule ID

cd072b25-a418-4f98-8ebc-5093fb38fe1a

Status

test

Level

low

Type

Detection

Created

Sun Aug 11

Modified

Wed Jan 04

Author

Austin Clark

Path

rules/network/cisco/aaa/cisco_cli_collect_data.yml

Raw Tags

attack.discoveryattack.credential-accessattack.collectionattack.t1087.001attack.t1552.001attack.t1005

View on GitHub