Cisco IOS Command Output Collection via Config Display Commands

title: Cisco IOS Command Output Collection via Config Display Commands
id: 383733a1-3d8c-4b87-a092-13172ef0662d
status: test
description: This rule flags Cisco IOS activity that outputs configuration data by matching specific command keywords used to display running and startup configurations and archived config. Attackers often collect these details to understand network/device settings and support later access, credential theft, or discovery. Telemetry relies on captured command text containing the listed configuration display terms.
references:
  - https://blog.router-switch.com/2013/11/show-running-config/
  - https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/cmdrefs/show_startup-config.htm
  - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/config-mgmt/configuration/15-sy/config-mgmt-15-sy-book/cm-config-diff.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_collect_data.yml
author: Austin Clark, Huntrule Team
date: 2019-08-11
modified: 2023-01-04
tags:
  - attack.discovery
  - attack.credential-access
  - attack.collection
  - attack.t1087.001
  - attack.t1552.001
  - attack.t1005
logsource:
  product: cisco
  service: aaa
detection:
  keywords:
    - show running-config
    - show startup-config
    - show archive config
    - more
  condition: keywords
falsepositives:
  - Commonly run by administrators
level: low
license: DRL-1.1
related:
  - id: cd072b25-a418-4f98-8ebc-5093fb38fe1a
    type: derived