Cisco AAA configuration changes enabling SPAN/RSPAN monitoring capture

ATT&CK techniques

Cred Access → Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1040Network Sniffing
Discovery
- T1040Network Sniffing
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Cisco AAA logs containing keywords related to configuring a monitor capture point or setting SPAN/RSPAN. Attackers can leverage span/rspan to capture traffic for credential discovery or internal reconnaissance without directly compromising endpoints. Detection relies on the presence of specific configuration/command keywords in Cisco AAA telemetry when monitoring is created or modified.

Reporting behind it

github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_net_sniff.yml

Related detections9 linkedT1040 — drag to rearrange

Suspicious Windows Native Pktmon Sniffer Abuse (via process_creation)

Suspicious Windows Traffic Capture Abuse (via process_creation)

Malicious TCP Session Hijacking via rshijack

PowerShell Start-NetEventSession Script Block Execution Indicating Potential Network Capture (Windows)

Windows PktMon.exe Process Execution (pktmon.exe / PktMon.exe)

macOS Network Sniffing Tool Execution via tcpdump or tshark

Windows Pcap Driver Installation via EID 4697 ServiceFileName

Windows Netsh.exe WLAN profile key clearing used for WiFi credential harvesting

Windows netsh Trace Start Command Execution

Cisco AAA configuration changes enabling SPAN/RSPAN monitoring capture

Pivot detection · T1040 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

cisco-aaa-monitor-span-rspan-capture-point-commands-b9e1f193

title: Cisco AAA configuration changes enabling SPAN/RSPAN monitoring capture
id: 0e416855-4816-496a-b1bc-702579297bba
status: test
description: This rule flags Cisco AAA logs containing keywords related to configuring a monitor capture point or setting SPAN/RSPAN. Attackers can leverage span/rspan to capture traffic for credential discovery or internal reconnaissance without directly compromising endpoints. Detection relies on the presence of specific configuration/command keywords in Cisco AAA telemetry when monitoring is created or modified.
author: Austin Clark, Huntrule Team
date: 2019-08-11
modified: 2023-01-04
tags:
  - attack.credential-access
  - attack.discovery
  - attack.t1040
logsource:
  product: cisco
  service: aaa
detection:
  keywords:
    - monitor capture point
    - set span
    - set rspan
  condition: keywords
falsepositives:
  - Admins may setup new or modify old spans, or use a monitor for troubleshooting
level: medium
license: DRL-1.1
related:
  - id: b9e1f193-d236-4451-aaae-2f3d2102120d
    type: derived
references:
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_net_sniff.yml

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL