aaa | Detection.FYI

Cisco Clear Logs

Aug 12, 2024 · attack.defense-evasion attack.t1070.003 ·

Clear command history in network OS which is used for defense evasion

Cisco Collect Data

Aug 12, 2024 · attack.discovery attack.credential-access attack.collection attack.t1087.001 attack.t1552.001 attack.t1005 ·

Share on:

Collect pertinent data from the configuration files

Cisco Crypto Commands

Aug 12, 2024 · attack.credential-access attack.defense-evasion attack.t1553.004 attack.t1552.004 ·

Share on:

Show when private keys are being exported from the device, or when new certificates are installed

Cisco Denial of Service

Aug 12, 2024 · attack.impact attack.t1495 attack.t1529 attack.t1565.001 ·

Share on:

Detect a system being shutdown or put into different boot mode

Cisco Disabling Logging

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Turn off logging locally or remote

Cisco Discovery

Aug 12, 2024 · attack.discovery attack.t1083 attack.t1201 attack.t1057 attack.t1018 attack.t1082 attack.t1016 attack.t1049 attack.t1033 attack.t1124 ·

Share on:

Find information about network devices that is not stored in config files

Cisco File Deletion

Aug 12, 2024 · attack.defense-evasion attack.impact attack.t1070.004 attack.t1561.001 attack.t1561.002 ·

Share on:

See what files are being deleted from flash file systems

Cisco Local Accounts

Aug 12, 2024 · attack.persistence attack.t1136.001 attack.t1098 ·

Share on:

Find local accounts being created or modified as well as remote authentication configurations

Cisco Modify Configuration

Aug 12, 2024 · attack.persistence attack.impact attack.t1490 attack.t1505 attack.t1565.002 attack.t1053 ·

Share on:

Modifications to a config that will serve an adversary's impacts or persistence

Cisco Show Commands Input

Aug 12, 2024 · attack.credential-access attack.t1552.003 ·

Share on:

See what commands are being input into the device by other people, full credentials can be in the history

Cisco Sniffing

Aug 12, 2024 · attack.credential-access attack.discovery attack.t1040 ·

Share on:

Show when a monitor or a span/rspan is setup or modified

Cisco Stage Data

Aug 12, 2024 · attack.collection attack.lateral-movement attack.command-and-control attack.exfiltration attack.t1074 attack.t1105 attack.t1560.001 ·

Share on:

Various protocols maybe used to put data on the device for exfil or infil