Cisco IOS/IOS-XE AAA Logs: Manual 802.1X (dot1x) Port-Authentication Disabled

title: "Cisco IOS/IOS-XE AAA Logs: Manual 802.1X (dot1x) Port-Authentication Disabled"
id: 0c4d69d5-6acf-4e41-bf81-9d09eb5788b7
status: experimental
description: This rule flags Cisco interface-level configuration changes that disable IEEE 802.1X (dot1x) by forcing the port to an authorized state or by removing dot1x port-control/authentication controls. Disabling 802.1X undermines Network Access Control by allowing devices to connect without completing 802.1X authentication. It relies on Cisco AAA command/log text containing specific dot1x-related keywords and negations indicating manual disablement (e.g., force-authorized or removing dot1x port-control/system-auth-control).
references:
  - https://www.cisco.com/en/US/docs/ios-xml/ios/san/command/san-xe-3se-3850-cr-book_chapter_00.html#wp3394428680
  - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-xe-3se-3850-cr-book/sec-a1-xe-3se-3850-cr-book_chapter_010.html#wp3502072400
  - https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_53_se/command/reference/2960ComRef/cli1.html#47220
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_dot1x_disabled.yml
author: Luc Génaux, Huntrule Team
date: 2026-04-28
tags:
  - attack.persistence
  - attack.credential-access
  - attack.defense-impairment
  - attack.t1685
  - attack.t1556.004
logsource:
  product: cisco
  service: aaa
detection:
  keywords:
    - access-session port-control force-authorized
    - authentication port-control force-authorized
    - dot1x port-control force-authorized
    - no access-session port-control
    - no authentication port-control
    - no dot1x port-control
    - no dot1x system-auth-control
  condition: keywords
falsepositives:
  - Administrator troubleshooting connectivity issues
level: medium
license: DRL-1.1
related:
  - id: ef0ff092-a24a-4fbc-beea-06c08d53e085
    type: derived