Cisco AAA discovery via show/dir commands

Alerts on Cisco AAA log entries with discovery-oriented 'dir' and 'show' command keywords.

FreeReviewedSigma · Low · v2

Product: cisco
Service: aaa
Author: Austin Clark (SigmaHQ), DRL 1.1
Published: 2019-08-12
Updated: 2026-07-31

ATT&CK techniques

Discovery

What it detects

This rule flags Cisco AAA activity containing common device discovery and system information commands, including directory listing and multiple show subcommands (e.g., ARP, CDP, clock, interfaces, routes, processes, users, version). Attackers often use these commands to enumerate network device state and services before further access or lateral movement. Detection relies on keyword matches in the observed command text within Cisco AAA telemetry.

Reporting behind it

Related detections9 linkedT1016 — drag to rearrange

Suspicious Reconnaissance Spawned by Injected SearchProtocolHost via process_creation

Windows Process Execution of PCHunter (PCHunter64.exe or PCHunter32.exe)

Windows Process Creation: Execution of Net.exe or Net1.exe

Suspicious Active Directory Subnet Enumeration via ADFind Subnets Query (via process_creation)

Suspicious Java Process Spawning Reconnaissance Commands via Cleo MFT (via process_creation)

Linux sysinfo Syscall for System Information Discovery

Windows Process Creation Signals for Pikabot System Discovery

Windows nltest.exe Execution for Network Information Discovery

Windows Process Creation: China Chopper Webshell Command Pattern via W3WP

Cisco AAA discovery via show/dir commands

Pivot detection · T1016 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

cisco-aaa-command-keyword-discovery-via-show-and-dir-9705a6a1

title: Cisco AAA discovery via show/dir commands
id: 138b21cf-573b-42d7-86a2-779563e6bf3e
status: test
description: This rule flags Cisco AAA activity containing common device discovery and system information commands, including directory listing and multiple show subcommands (e.g., ARP, CDP, clock, interfaces, routes, processes, users, version). Attackers often use these commands to enumerate network device state and services before further access or lateral movement. Detection relies on keyword matches in the observed command text within Cisco AAA telemetry.
references:
  - https://www.cisco.com/c/en/us/td/docs/server_nw_virtual/2-5_release/command_reference/show.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_discovery.yml
author: Austin Clark, Huntrule Team
date: 2019-08-12
modified: 2023-01-04
tags:
  - attack.discovery
  - attack.t1083
  - attack.t1201
  - attack.t1057
  - attack.t1018
  - attack.t1082
  - attack.t1016
  - attack.t1049
  - attack.t1033
  - attack.t1124
logsource:
  product: cisco
  service: aaa
detection:
  keywords:
    - dir
    - show arp
    - show cdp
    - show clock
    - show ip interface
    - show ip route
    - show ip sockets
    - show processes
    - show ssh
    - show users
    - show version
  condition: keywords
falsepositives:
  - Commonly used by administrators for troubleshooting
level: low
license: DRL-1.1
related:
  - id: 9705a6a1-6db6-4a16-a987-15b7151e299b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL