huntrule

Cisco AAA commands triggering shutdown or boot mode via config-register values

Flags Cisco AAA events referencing shutdown or config-register 0x2100/0x2142 changes that may disrupt boot or availability.

FreeUnreviewedSigmamediumv1
title: Cisco AAA commands triggering shutdown or boot mode via config-register values
id: ca19c475-09a2-4067-be33-1b6472f2058a
status: test
description: This rule matches Cisco AAA log events containing the keywords 'shutdown' or specific 'config-register' values (0x2100, 0x2142). These actions can indicate an attempt to disrupt availability or alter boot behavior, which may precede or support impact techniques. The detection relies on keyword presence in AAA-related telemetry where these command strings appear.
author: Austin Clark, Huntrule Team
date: 2019-08-15
modified: 2023-01-04
tags:
  - attack.impact
  - attack.t1495
  - attack.t1529
  - attack.t1565.001
logsource:
  product: cisco
  service: aaa
detection:
  keywords:
    - shutdown
    - config-register 0x2100
    - config-register 0x2142
  condition: keywords
falsepositives:
  - Legitimate administrators may run these commands, though rarely.
level: medium
license: DRL-1.1
related:
  - id: d94a35f0-7a29-45f6-90a0-80df6159967c
    type: derived
references:
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_dos.yml

What it detects

This rule matches Cisco AAA log events containing the keywords 'shutdown' or specific 'config-register' values (0x2100, 0x2142). These actions can indicate an attempt to disrupt availability or alter boot behavior, which may precede or support impact techniques. The detection relies on keyword presence in AAA-related telemetry where these command strings appear.

Known false positives

  • Legitimate administrators may run these commands, though rarely.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.