Cisco AAA CLI Configuration Commands (HTTP/HTTPS, KRON, ACL, NTP) Modification

Flags Cisco AAA command activity that includes keywords for configuration changes like HTTP/HTTPS, KRON, ACLs, and NTP.

FreeUnreviewedSigmamediumv1

cisco-aaa-cli-configuration-commands-http-https-kron-acl-ntp-modification-671ffc77

title: Cisco AAA CLI Configuration Commands (HTTP/HTTPS, KRON, ACL, NTP) Modification
id: d2a7a20b-1bea-41ca-a9c8-7ee55facbc90
status: test
description: This rule matches Cisco AAA-related command lines containing keywords associated with changing device configuration, including enabling HTTP/HTTPS services, configuring KRON policy lists and occurrences, modifying access control lists, and setting NTP server settings. Such configuration changes can help an attacker establish persistence, influence execution paths, or increase impact on the network device. Detection relies on text telemetry of the executed command content containing the listed configuration keywords.
author: Austin Clark, Huntrule Team
date: 2019-08-12
modified: 2025-04-28
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.impact
  - attack.t1490
  - attack.t1505
  - attack.t1565.002
  - attack.t1053
logsource:
  product: cisco
  service: aaa
detection:
  keywords:
    - ip http server
    - ip https server
    - kron policy-list
    - kron occurrence
    - policy-list
    - access-list
    - ip access-group
    - archive maximum
    - ntp server
  condition: keywords
falsepositives:
  - Legitimate administrators may run these commands
level: medium
license: DRL-1.1
related:
  - id: 671ffc77-50a7-464f-9e3d-9ea2b493b26b
    type: derived
references:
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_modify_config.yml

What it detects

This rule matches Cisco AAA-related command lines containing keywords associated with changing device configuration, including enabling HTTP/HTTPS services, configuring KRON policy lists and occurrences, modifying access control lists, and setting NTP server settings. Such configuration changes can help an attacker establish persistence, influence execution paths, or increase impact on the network device. Detection relies on text telemetry of the executed command content containing the listed configuration keywords.

Known false positives

Legitimate administrators may run these commands

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.