huntrule

Cisco AAA: Detection of 'show history' and 'show logging' command input

Alerts on Cisco AAA command input attempting to view history or logging via 'show history'/'show logging' commands.

FreeReviewedSigma · Medium · v2
Product
cisco
Service
aaa
Author
Austin Clark (SigmaHQ), DRL 1.1
Published
2019-08-11
Updated
2026-07-31
AnalysisDetection
title: "Cisco AAA: Detection of 'show history' and 'show logging' command input"
id: 0b492552-9cc1-41d5-83c7-4c566be57096
status: test
description: This rule identifies Cisco AAA activity where command input matches 'show history', 'show history all', or 'show logging'. These commands can reveal previously executed commands and logging information that may contain sensitive data, including credentials captured in command history. It relies on telemetry from Cisco AAA reflecting the entered CLI commands and keyword matching within that input.
author: Austin Clark, Huntrule Team
date: 2019-08-11
modified: 2023-01-04
tags:
  - attack.credential-access
  - attack.t1552.003
logsource:
  product: cisco
  service: aaa
detection:
  keywords:
    - show history
    - show history all
    - show logging
  condition: keywords
falsepositives:
  - Not commonly run by administrators, especially if remote logging is configured
level: medium
license: DRL-1.1
related:
  - id: b094d9fb-b1ad-4650-9f1a-fb7be9f1d34b
    type: derived
references:
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_input_capture.yml