Cisco IOS AAA Crypto PKI Export/Import Commands

Alerts on Cisco IOS AAA logs showing crypto PKI export of private keys or PKI import of certificates/trustpoints.

FreeReviewedSigma · High · v2

Product: cisco
Service: aaa
Author: Austin Clark (SigmaHQ), DRL 1.1
Published: 2019-08-12
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion → Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1553.004Install Root Certificate
Cred Access
- T1552.004Private Keys
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Cisco IOS AAA log entries containing commands related to exporting or importing PKI material, including crypto pki export, crypto pki import, and crypto pki trustpoint. Attackers may leverage PKI export to steal private keys or use PKI import/trustpoint changes to establish or replace trusted certificates for interception and persistent access. The detection relies on keyword matches observed in Cisco AAA telemetry for these specific crypto PKI command phrases.

Reporting behind it

Related detections9 linkedT1552.004 — drag to rearrange

Suspicious Process Memory Read from Proc Mem for Secret Extraction

Suspicious Double Base64 Decoded Payload Piped to Shell in CI (reviewdog Supply Chain)

Suspicious Object Access to DPAPI Machine Keys and System Protect Directories (via security)

Suspicious macOS Local Credential Validation via dscl authonly

Suspicious Credential File Harvesting of NPM Claude and SSH Secrets

Suspicious SharpDPAPI Machine Masterkey Extraction (via process_creation)

Suspicious Credential File Discovery via Find on Linux

Possible CI Runner Memory Scraping via Python Process Memory Read (tj-actions Supply Chain)

Windows File Writes Matching DPAPI Backup Key and Certificate Export Filenames

Cisco IOS AAA Crypto PKI Export/Import Commands

Pivot detection · T1552.004 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

cisco-ios-aaa-crypto-pki-commands-for-key-export-or-certificate-import-1f978c6a

title: Cisco IOS AAA Crypto PKI Export/Import Commands
id: 820455b6-30a9-4c72-8893-6fc9009ffefe
status: test
description: This rule flags Cisco IOS AAA log entries containing commands related to exporting or importing PKI material, including crypto pki export, crypto pki import, and crypto pki trustpoint. Attackers may leverage PKI export to steal private keys or use PKI import/trustpoint changes to establish or replace trusted certificates for interception and persistent access. The detection relies on keyword matches observed in Cisco AAA telemetry for these specific crypto PKI command phrases.
references:
  - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-cr-book/sec-a1-cr-book_chapter_0111.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_crypto_actions.yml
author: Austin Clark, Huntrule Team
date: 2019-08-12
modified: 2023-01-04
tags:
  - attack.credential-access
  - attack.defense-impairment
  - attack.t1553.004
  - attack.t1552.004
logsource:
  product: cisco
  service: aaa
detection:
  keywords:
    - crypto pki export
    - crypto pki import
    - crypto pki trustpoint
  condition: keywords
falsepositives:
  - Not commonly run by administrators. Also whitelist your known good certificates
level: high
license: DRL-1.1
related:
  - id: 1f978c6a-4415-47fb-aca5-736a44d7ca3d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL