huntrule

Cisco IOS AAA Crypto PKI Export/Import Commands

Alerts on Cisco IOS AAA logs showing crypto PKI export of private keys or PKI import of certificates/trustpoints.

FreeReviewedSigma · High · v2
Product
cisco
Service
aaa
Author
Austin Clark (SigmaHQ), DRL 1.1
Published
2019-08-12
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion → Cred Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Cisco IOS AAA log entries containing commands related to exporting or importing PKI material, including crypto pki export, crypto pki import, and crypto pki trustpoint. Attackers may leverage PKI export to steal private keys or use PKI import/trustpoint changes to establish or replace trusted certificates for interception and persistent access. The detection relies on keyword matches observed in Cisco AAA telemetry for these specific crypto PKI command phrases.

Reporting behind it

Related detections9 linkedT1553.004 — drag to rearrange
Suspicious Certutil Download and Certificate Installation via Living-off-the-Land
Suspicious Shadow File Exfiltration Over Dev TCP on Linux via Process Creation (via process_creation)
Suspicious Firefox Enterprise Root Certificate Trust Enabled
Malicious Root Certificate Installed via certutil addstore for AiTM Interception
Malicious Root Certificate Installation via certutil
Suspicious Root Certificate Installation via certutil (via process_creation)
Suspicious Process Memory Read from Proc Mem for Secret Extraction
Suspicious Double Base64 Decoded Payload Piped to Shell in CI (reviewdog Supply Chain)
Suspicious Object Access to DPAPI Machine Keys and System Protect Directories (via security)
Cisco IOS AAA Crypto PKI Export/Import Commands
Pivot detection · T1553.004 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.