Cisco AAA Configuration Modification Command Patterns

ATT&CK techniques

Execution → Impact

Recon
Resource Dev
Initial Access
Execution
- T1053Scheduled Task/Job
Persistence
- T1053Scheduled Task/Job
- T1505Server Software Component
Priv Esc
- T1053Scheduled Task/Job
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1490Inhibit System Recovery
- T1565.002Transmitted Data Manipulation

What it detects

This rule flags Cisco AAA-related configuration change commands containing specific keywords. Such changes can enable attacker impact or persistence by altering services, scheduling behavior, access controls, or related network settings. It relies on telemetry that records the presence of these command keywords in the observed activity. Legitimate administrative changes may also match, so analyst review is required.

Reporting behind it

github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_modify_config.yml

Related detections9 linkedT1490 — drag to rearrange

Malicious Mass Hyper-V Virtual Machine Shutdown via PowerShell by Kraken Ransomware

Suspicious Shadow Copy Deletion via Vssadmin by Kraken Ransomware

Malicious Volume Shadow Copy Deletion via vssadmin or WMIC

Malicious Volume Shadow Copy Deletion via vssadmin

Suspicious Free Space Wipe via cipher.exe

Malicious Shadow Copy Deletion Via WMI

Volume Shadow Copy Deletion via vssadmin or wmic

Malicious Inhibit System Recovery via Backup and Shadow Copy Deletion (via process_creation)

Malicious Shadow Copy Deletion via vssadmin

Cisco AAA Configuration Modification Command Patterns

Pivot detection · T1490 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

cisco-aaa-cli-configuration-commands-http-https-kron-acl-ntp-modification-671ffc77

title: Cisco AAA Configuration Modification Command Patterns
id: d2a7a20b-1bea-41ca-a9c8-7ee55facbc90
status: test
description: This rule flags Cisco AAA-related configuration change commands containing specific keywords. Such changes can enable attacker impact or persistence by altering services, scheduling behavior, access controls, or related network settings. It relies on telemetry that records the presence of these command keywords in the observed activity. Legitimate administrative changes may also match, so analyst review is required.
author: Austin Clark, Huntrule Team
date: 2019-08-12
modified: 2025-04-28
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.impact
  - attack.t1490
  - attack.t1505
  - attack.t1565.002
  - attack.t1053
logsource:
  product: cisco
  service: aaa
detection:
  keywords:
    - ip http server
    - ip https server
    - kron policy-list
    - kron occurrence
    - policy-list
    - access-list
    - ip access-group
    - archive maximum
    - ntp server
  condition: keywords
falsepositives:
  - Legitimate administrators may run these commands
level: medium
license: DRL-1.1
related:
  - id: 671ffc77-50a7-464f-9e3d-9ea2b493b26b
    type: derived
references:
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_modify_config.yml

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL