Cisco AAA Command Output Collection: show running/startup-config and archive config

Detects Cisco command strings attempting to collect device configuration via show running/startup/archived config.

FreeReviewedSigma · Low · v2

Product: cisco
Service: aaa
Author: Austin Clark (SigmaHQ), DRL 1.1
Published: 2019-08-11
Updated: 2026-07-31

ATT&CK techniques

Cred Access → Collection

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1552.001Credentials In Files
Discovery
- T1087.001Local Account
Lateral Movement
Collection
- T1005Data from Local System
C2
Exfiltration
Impact

What it detects

This rule flags Cisco AAA activity where command output appears to be collected using configuration-display commands such as “show running-config”, “show startup-config”, and “show archive config”. Attackers can use these commands to inventory device configuration, identify services and credentials, and support subsequent access or lateral movement. It relies on AAA telemetry that records the observed command text, matching the listed keywords.

Reporting behind it

Related detections9 linkedT1552.001 — drag to rearrange

Suspicious UAT-10608 Hidden Credential Harvesting Script Execution via nohup

Suspicious BoryptGrab Infostealer Staging Directory (via file_event)

Suspicious Access to Cloud and Database Credential Files via Process

Suspicious Astaroth Spambot Browser Profile Staging Directory (via file_event)

Suspicious Credential Exfiltration to webhook.site (via dns_query)

Suspicious Shai-Hulud Worm Stager Execution from Temp (via process_creation)

Suspicious prt-scan Campaign Credential Harvesting via proc environ Scan (via process_creation)

Possible Stolen AWS Credential Validation via STS GetCallerIdentity

Suspicious Double Base64 Decoded Payload Piped to Shell in CI (reviewdog Supply Chain)

Cisco AAA Command Output Collection: show running/startup-config and archive config

Pivot detection · T1552.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

cisco-ios-command-output-collection-via-config-display-commands-cd072b25

title: "Cisco AAA Command Output Collection: show running/startup-config and archive config"
id: 383733a1-3d8c-4b87-a092-13172ef0662d
status: test
description: This rule flags Cisco AAA activity where command output appears to be collected using configuration-display commands such as “show running-config”, “show startup-config”, and “show archive config”. Attackers can use these commands to inventory device configuration, identify services and credentials, and support subsequent access or lateral movement. It relies on AAA telemetry that records the observed command text, matching the listed keywords.
references:
  - https://blog.router-switch.com/2013/11/show-running-config/
  - https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/cmdrefs/show_startup-config.htm
  - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/config-mgmt/configuration/15-sy/config-mgmt-15-sy-book/cm-config-diff.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_collect_data.yml
author: Austin Clark, Huntrule Team
date: 2019-08-11
modified: 2023-01-04
tags:
  - attack.discovery
  - attack.credential-access
  - attack.collection
  - attack.t1087.001
  - attack.t1552.001
  - attack.t1005
logsource:
  product: cisco
  service: aaa
detection:
  keywords:
    - show running-config
    - show startup-config
    - show archive config
    - more
  condition: keywords
falsepositives:
  - Commonly run by administrators
level: low
license: DRL-1.1
related:
  - id: cd072b25-a418-4f98-8ebc-5093fb38fe1a
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL