Detectionhightest

Cisco Clear Logs

Clear command history in network OS which is used for defense evasion

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Austin ClarkCreated Mon Aug 12Updated Fri May 26ceb407f6-8277-439b-951f-e4210e3ed956network

Log Source

Ciscoaaa

ProductCisco← raw: cisco

Serviceaaa← raw: aaa

Detection Logic

detection:
    keywords:
        - 'clear logging'
        - 'clear archive'
    condition: keywords

False Positives

Legitimate administrators may run these commands

References

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

ceb407f6-8277-439b-951f-e4210e3ed956

Status

test

Level

high

Type

Detection

Created

Mon Aug 12

Modified

Fri May 26

Author

Path

rules/network/cisco/aaa/cisco_cli_clear_logs.yml

Raw Tags

attack.defense-evasionattack.t1070.003