Cisco AAA Command Keyword Discovery via 'show' and 'dir'

title: Cisco AAA Command Keyword Discovery via 'show' and 'dir'
id: 138b21cf-573b-42d7-86a2-779563e6bf3e
status: test
description: This rule flags Cisco AAA activity containing common device-discovery command strings such as 'dir' and multiple 'show ...' queries (e.g., ARP, CDP, routes, version, users, and SSH). Attackers may use these commands to inventory network devices, interfaces, services, and system details before further actions. Telemetry relies on the AAA logs containing the exact keyword text in the observed command or request content.
references:
  - https://www.cisco.com/c/en/us/td/docs/server_nw_virtual/2-5_release/command_reference/show.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_discovery.yml
author: Austin Clark, Huntrule Team
date: 2019-08-12
modified: 2023-01-04
tags:
  - attack.discovery
  - attack.t1083
  - attack.t1201
  - attack.t1057
  - attack.t1018
  - attack.t1082
  - attack.t1016
  - attack.t1049
  - attack.t1033
  - attack.t1124
logsource:
  product: cisco
  service: aaa
detection:
  keywords:
    - dir
    - show arp
    - show cdp
    - show clock
    - show ip interface
    - show ip route
    - show ip sockets
    - show processes
    - show ssh
    - show users
    - show version
  condition: keywords
falsepositives:
  - Commonly used by administrators for troubleshooting
level: low
license: DRL-1.1
related:
  - id: 9705a6a1-6db6-4a16-a987-15b7151e299b
    type: derived