Cisco AAA Logging Disabled via 'no logging' and 'no aaa new-model'

Flags Cisco AAA command text that includes 'no logging' and/or 'no aaa new-model' to indicate logging being turned off.

FreeUnreviewedSigmahighv1

cisco-aaa-logging-disabled-via-no-logging-and-no-aaa-new-model-9e8f6035

title: Cisco AAA Logging Disabled via 'no logging' and 'no aaa new-model'
id: da0f6f0c-9fa4-465c-8929-85f1df6eeba0
status: test
description: This rule matches command lines on Cisco systems that disable logging locally or remotely by using the 'no logging' and 'no aaa new-model' keywords. Disabling or reducing logging can help attackers reduce visibility and hinder incident response. It relies on telemetry that records Cisco AAA-related configuration or command text containing these specific keywords.
references:
  - https://www.cisco.com/en/US/docs/ios/security/command/reference/sec_a2.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_disable_logging.yml
author: Austin Clark, Huntrule Team
date: 2019-08-11
modified: 2023-01-04
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: cisco
  service: aaa
detection:
  keywords:
    - no logging
    - no aaa new-model
  condition: keywords
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 9e8f6035-88bf-4a63-96b6-b17c0508257e
    type: derived

What it detects

This rule matches command lines on Cisco systems that disable logging locally or remotely by using the 'no logging' and 'no aaa new-model' keywords. Disabling or reducing logging can help attackers reduce visibility and hinder incident response. It relies on telemetry that records Cisco AAA-related configuration or command text containing these specific keywords.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.