Cisco AAA: Local account creation/modification and remote authentication configuration changes

Flags Cisco AAA log events showing local username/account changes and remote authentication configuration updates.

FreeUnreviewedSigmahighv1

cisco-aaa-local-account-creation-modification-and-remote-authentication-configur-6d844f0f

title: "Cisco AAA: Local account creation/modification and remote authentication configuration changes"
id: 0ba8a740-3581-405e-91b7-d36b3b3a3f46
status: test
description: This rule looks for Cisco AAA events containing the keywords "username" and "aaa" that indicate local account creation or modification, as well as changes to remote authentication settings. Attackers may add or update local credentials to establish persistence and maintain access even if external authentication is disrupted. The detection relies on available Cisco AAA log content and matches events based on keyword presence.
author: Austin Clark, Huntrule Team
date: 2019-08-12
modified: 2023-01-04
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1136.001
  - attack.t1098
logsource:
  product: cisco
  service: aaa
detection:
  keywords:
    - username
    - aaa
  condition: keywords
falsepositives:
  - When remote authentication is in place, this should not change often
level: high
license: DRL-1.1
related:
  - id: 6d844f0f-1c18-41af-8f19-33e7654edfc3
    type: derived
references:
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_local_accounts.yml

What it detects

This rule looks for Cisco AAA events containing the keywords "username" and "aaa" that indicate local account creation or modification, as well as changes to remote authentication settings. Attackers may add or update local credentials to establish persistence and maintain access even if external authentication is disrupted. The detection relies on available Cisco AAA log content and matches events based on keyword presence.

Known false positives

When remote authentication is in place, this should not change often

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.