Cisco AAA Command Output Collection: show running/startup-config and archive config

Detects Cisco command strings attempting to collect device configuration via show running/startup/archived config.

FreeReviewedSigma · Low · v2

Product: cisco
Service: aaa
Author: Austin Clark (SigmaHQ), DRL 1.1
Published: 2019-08-11
Updated: 2026-07-31

ATT&CK techniques

Cred Access → Collection

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1552.001Credentials In Files
Discovery
- T1087.001Local Account
Lateral Movement
Collection
- T1005Data from Local System
C2
Exfiltration
Impact

What it detects

This rule flags Cisco AAA activity where command output appears to be collected using configuration-display commands such as “show running-config”, “show startup-config”, and “show archive config”. Attackers can use these commands to inventory device configuration, identify services and credentials, and support subsequent access or lateral movement. It relies on AAA telemetry that records the observed command text, matching the listed keywords.

Reporting behind it

Related detections9 linkedT1552.001 — drag to rearrange

Suspicious sqlcipher Decryption of Signal Database by WAVESIGN (via process_creation)

Malicious Velvet Ant Linux Backdoor and Credential Harvesting Artifacts (via file_event)

Malicious Browser Credential Dump File Drop by Phantom Stealer via file_event

Suspicious TruffleHog Execution Spawned by Bun Runtime via Process Creation

Malicious AWS Credential Exfiltration via Curl or Wget in Process Creation

Suspicious sqlite3 Access to gcloud Cached Access Token Database (via process_creation)

Suspicious AWS GetCallerIdentity From TruffleHog User Agent via Cloudtrail

Suspicious GitHub CLI Auth Token Extraction via Command Line

Suspicious Cryptocurrency Wallet File Access by Stealer (via process_creation)

Cisco AAA Command Output Collection: show running/startup-config and archive config

Pivot detection · T1552.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

cisco-ios-command-output-collection-via-config-display-commands-cd072b25

title: "Cisco AAA Command Output Collection: show running/startup-config and archive config"
id: 383733a1-3d8c-4b87-a092-13172ef0662d
status: test
description: This rule flags Cisco AAA activity where command output appears to be collected using configuration-display commands such as “show running-config”, “show startup-config”, and “show archive config”. Attackers can use these commands to inventory device configuration, identify services and credentials, and support subsequent access or lateral movement. It relies on AAA telemetry that records the observed command text, matching the listed keywords.
references:
  - https://blog.router-switch.com/2013/11/show-running-config/
  - https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/cmdrefs/show_startup-config.htm
  - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/config-mgmt/configuration/15-sy/config-mgmt-15-sy-book/cm-config-diff.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_collect_data.yml
author: Austin Clark, Huntrule Team
date: 2019-08-11
modified: 2023-01-04
tags:
  - attack.discovery
  - attack.credential-access
  - attack.collection
  - attack.t1087.001
  - attack.t1552.001
  - attack.t1005
logsource:
  product: cisco
  service: aaa
detection:
  keywords:
    - show running-config
    - show startup-config
    - show archive config
    - more
  condition: keywords
falsepositives:
  - Commonly run by administrators
level: low
license: DRL-1.1
related:
  - id: cd072b25-a418-4f98-8ebc-5093fb38fe1a
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL