Cisco AAA File Deletion Activity via erase, delete, or format keywords

Flags Cisco AAA log entries referencing flash file erase, delete, or format operations that may indicate stealthy cleanup.

FreeUnreviewedSigmamediumv1

cisco-aaa-file-deletion-activity-via-erase-delete-or-format-keywords-71d65515

title: Cisco AAA File Deletion Activity via erase, delete, or format keywords
id: 5d19fe60-7ba3-495f-9ae5-5556a62d0fdf
status: test
description: This rule matches Cisco AAA log events containing keywords associated with file removal or storage cleanup on device flash file systems, such as erase, delete, or format. Attackers may use file deletion to reduce forensic artifacts or disrupt local persistence, making this activity valuable for identifying potential stealthy impact. It relies on text-matching over Cisco AAA telemetry fields where these keywords appear in the event content.
author: Austin Clark, Huntrule Team
date: 2019-08-12
modified: 2023-01-04
tags:
  - attack.impact
  - attack.stealth
  - attack.t1070.004
  - attack.t1561.001
  - attack.t1561.002
logsource:
  product: cisco
  service: aaa
detection:
  keywords:
    - erase
    - delete
    - format
  condition: keywords
falsepositives:
  - Will be used sometimes by admins to clean up local flash space
level: medium
license: DRL-1.1
related:
  - id: 71d65515-c436-43c0-841b-236b1f32c21e
    type: derived
references:
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_file_deletion.yml

What it detects

This rule matches Cisco AAA log events containing keywords associated with file removal or storage cleanup on device flash file systems, such as erase, delete, or format. Attackers may use file deletion to reduce forensic artifacts or disrupt local persistence, making this activity valuable for identifying potential stealthy impact. It relies on text-matching over Cisco AAA telemetry fields where these keywords appear in the event content.

Known false positives

Will be used sometimes by admins to clean up local flash space

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.