Cisco AAA Configuration Modification Command Patterns

Flags Cisco AAA command activity that includes keywords for configuration changes like HTTP/HTTPS, KRON, ACLs, and NTP.

FreeReviewedSigma · Medium · v2

Product: cisco
Service: aaa
Author: Austin Clark (SigmaHQ), DRL 1.1
Published: 2019-08-12
Updated: 2026-07-31

ATT&CK techniques

Execution → Impact

Recon
Resource Dev
Initial Access
Execution
- T1053Scheduled Task/Job
Persistence
- T1053Scheduled Task/Job
- T1505Server Software Component
Priv Esc
- T1053Scheduled Task/Job
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1490Inhibit System Recovery
- T1565.002Transmitted Data Manipulation

What it detects

This rule flags Cisco AAA-related configuration change commands containing specific keywords. Such changes can enable attacker impact or persistence by altering services, scheduling behavior, access controls, or related network settings. It relies on telemetry that records the presence of these command keywords in the observed activity. Legitimate administrative changes may also match, so analyst review is required.

Reporting behind it

github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_modify_config.yml

Related detections9 linkedT1490 — drag to rearrange

Malicious Unsigned VIB Installation on ESXi Host via esxcli (via process_creation)

Malicious Fire Ant Hypervisor Backdoor Artifacts on ESXi and vCenter (via file_event)

Malicious Volume Shadow Copy Deletion via wmic and vssadmin (via process_creation)

Malicious System Recovery Inhibition via bcdedit and vssadmin in Mallox

Malicious Shadow Copy Deletion via WMIC via Process Creation (via process_creation)

Suspicious Anti-Recovery Zeroing via fsutil setZeroData (via process_creation)

Malicious Shadow Copy Removal via WMI PowerShell

Malicious Volume Shadow Copy Deletion via vssadmin

Malicious Inhibit System Recovery via Shadow Copy and Boot Config Tampering (via process_creation)

Cisco AAA Configuration Modification Command Patterns

Pivot detection · T1490 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

cisco-aaa-cli-configuration-commands-http-https-kron-acl-ntp-modification-671ffc77

title: Cisco AAA Configuration Modification Command Patterns
id: d2a7a20b-1bea-41ca-a9c8-7ee55facbc90
status: test
description: This rule flags Cisco AAA-related configuration change commands containing specific keywords. Such changes can enable attacker impact or persistence by altering services, scheduling behavior, access controls, or related network settings. It relies on telemetry that records the presence of these command keywords in the observed activity. Legitimate administrative changes may also match, so analyst review is required.
author: Austin Clark, Huntrule Team
date: 2019-08-12
modified: 2025-04-28
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.impact
  - attack.t1490
  - attack.t1505
  - attack.t1565.002
  - attack.t1053
logsource:
  product: cisco
  service: aaa
detection:
  keywords:
    - ip http server
    - ip https server
    - kron policy-list
    - kron occurrence
    - policy-list
    - access-list
    - ip access-group
    - archive maximum
    - ntp server
  condition: keywords
falsepositives:
  - Legitimate administrators may run these commands
level: medium
license: DRL-1.1
related:
  - id: 671ffc77-50a7-464f-9e3d-9ea2b493b26b
    type: derived
references:
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_modify_config.yml

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL