Cisco IOS AAA Crypto PKI Commands for Key Export or Certificate Import

Alerts on Cisco IOS AAA logs showing crypto PKI export of private keys or PKI import of certificates/trustpoints.

FreeUnreviewedSigmahighv1

cisco-ios-aaa-crypto-pki-commands-for-key-export-or-certificate-import-1f978c6a

title: Cisco IOS AAA Crypto PKI Commands for Key Export or Certificate Import
id: 820455b6-30a9-4c72-8893-6fc9009ffefe
status: test
description: This rule flags Cisco IOS AAA activity containing commands to export private keys or import PKI certificates and trustpoints. Attackers may use these actions to obtain credentials or modify the device’s trust relationships to enable further access. It relies on telemetry that records AAA logs with the specific crypto PKI command keywords.
references:
  - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-cr-book/sec-a1-cr-book_chapter_0111.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_crypto_actions.yml
author: Austin Clark, Huntrule Team
date: 2019-08-12
modified: 2023-01-04
tags:
  - attack.credential-access
  - attack.defense-impairment
  - attack.t1553.004
  - attack.t1552.004
logsource:
  product: cisco
  service: aaa
detection:
  keywords:
    - crypto pki export
    - crypto pki import
    - crypto pki trustpoint
  condition: keywords
falsepositives:
  - Not commonly run by administrators. Also whitelist your known good certificates
level: high
license: DRL-1.1
related:
  - id: 1f978c6a-4415-47fb-aca5-736a44d7ca3d
    type: derived

What it detects

This rule flags Cisco IOS AAA activity containing commands to export private keys or import PKI certificates and trustpoints. Attackers may use these actions to obtain credentials or modify the device’s trust relationships to enable further access. It relies on telemetry that records AAA logs with the specific crypto PKI command keywords.

Known false positives

Not commonly run by administrators. Also whitelist your known good certificates

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.