Sigma Rules
17 rules found
Cisco Duo Successful MFA Authentication Via Bypass Code
Detects when a successful MFA authentication occurs due to the use of a bypass code. A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as "backup codes," so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can't use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems.
Cisco Clear Logs
Clear command history in network OS which is used for defense evasion
Cisco Collect Data
Collect pertinent data from the configuration files
Cisco Crypto Commands
Show when private keys are being exported from the device, or when new certificates are installed
Cisco Disabling Logging
Turn off logging locally or remote
Cisco Discovery
Find information about network devices that is not stored in config files
Cisco Denial of Service
Detect a system being shutdown or put into different boot mode
Cisco Dot1x Disabled
Detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface. Disabling dot1x bypasses Network Access Control (NAC) mechanisms, potentially allowing unauthorized devices to gain access to the internal network. This activity is a common technique used by attackers or malicious insiders to establish persistence or perform lateral movement via rogue devices.
Cisco File Deletion
See what files are being deleted from flash file systems
Cisco Show Commands Input
See what commands are being input into the device by other people, full credentials can be in the history
Cisco Local Accounts
Find local accounts being created or modified as well as remote authentication configurations
Cisco Modify Configuration
Modifications to a config that will serve an adversary's impacts or persistence
Cisco Stage Data
Various protocols maybe used to put data on the device for exfil or infil
Cisco Sniffing
Show when a monitor or a span/rspan is setup or modified
Cisco BGP Authentication Failures
Detects BGP failures which may be indicative of brute force attacks to manipulate routing
Cisco LDP Authentication Failures
Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels
Exploitation Indicators Of CVE-2023-20198
Detecting exploitation indicators of CVE-2023-20198 a privilege escalation vulnerability in Cisco IOS XE Software Web UI.