Cisco AAA: Monitor/SPAN/RSPAN capture point commands

Alerts on Cisco AAA logs referencing SPAN/RSPAN or monitor capture point configuration changes.

FreeUnreviewedSigmamediumv1

cisco-aaa-monitor-span-rspan-capture-point-commands-b9e1f193

title: "Cisco AAA: Monitor/SPAN/RSPAN capture point commands"
id: 0e416855-4816-496a-b1bc-702579297bba
status: test
description: This rule flags Cisco AAA events containing commands or phrases used to configure or change packet capture on network devices, specifically monitor capture points and SPAN/RSPAN settings. Attackers can use these capabilities to observe traffic for discovery or credential access. It relies on keyword matches in AAA-related Cisco telemetry for the presence of those SPAN/RSPAN configuration terms.
author: Austin Clark, Huntrule Team
date: 2019-08-11
modified: 2023-01-04
tags:
  - attack.credential-access
  - attack.discovery
  - attack.t1040
logsource:
  product: cisco
  service: aaa
detection:
  keywords:
    - monitor capture point
    - set span
    - set rspan
  condition: keywords
falsepositives:
  - Admins may setup new or modify old spans, or use a monitor for troubleshooting
level: medium
license: DRL-1.1
related:
  - id: b9e1f193-d236-4451-aaae-2f3d2102120d
    type: derived
references:
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_net_sniff.yml

What it detects

This rule flags Cisco AAA events containing commands or phrases used to configure or change packet capture on network devices, specifically monitor capture points and SPAN/RSPAN settings. Attackers can use these capabilities to observe traffic for discovery or credential access. It relies on keyword matches in AAA-related Cisco telemetry for the presence of those SPAN/RSPAN configuration terms.

Known false positives

Admins may setup new or modify old spans, or use a monitor for troubleshooting

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.