huntrule

Cisco AAA Captures 'show history' and 'show logging' Command Input

Alerts on Cisco AAA command input attempting to view history or logging via 'show history'/'show logging' commands.

FreeUnreviewedSigmamediumv1
title: Cisco AAA Captures 'show history' and 'show logging' Command Input
id: 0b492552-9cc1-41d5-83c7-4c566be57096
status: test
description: This rule flags command input that matches 'show history', 'show history all', or 'show logging' in Cisco AAA logs. Such commands can be used by an attacker to enumerate or retrieve prior activity, potentially exposing sensitive command sequences and credentials stored in command history. Detection relies on keyword matches within the recorded AAA command/interaction telemetry.
author: Austin Clark, Huntrule Team
date: 2019-08-11
modified: 2023-01-04
tags:
  - attack.credential-access
  - attack.t1552.003
logsource:
  product: cisco
  service: aaa
detection:
  keywords:
    - show history
    - show history all
    - show logging
  condition: keywords
falsepositives:
  - Not commonly run by administrators, especially if remote logging is configured
level: medium
license: DRL-1.1
related:
  - id: b094d9fb-b1ad-4650-9f1a-fb7be9f1d34b
    type: derived
references:
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_input_capture.yml

What it detects

This rule flags command input that matches 'show history', 'show history all', or 'show logging' in Cisco AAA logs. Such commands can be used by an attacker to enumerate or retrieve prior activity, potentially exposing sensitive command sequences and credentials stored in command history. Detection relies on keyword matches within the recorded AAA command/interaction telemetry.

Known false positives

  • Not commonly run by administrators, especially if remote logging is configured

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.