Cisco Network Device 802.1X (dot1x) Disabled via port-control Force-Authorized
Alerts on Cisco configuration changes that disable 802.1X on a port (force-authorized or no dot1x port-control).
- Product
- cisco
- Service
- aaa
- Author
- Luc Génaux (SigmaHQ), DRL 1.1
- Published
- 2026-04-28
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches Cisco AAA/service CLI command strings used to disable IEEE 802.1X (dot1x) on an interface by forcing the port into an authorized state without 802.1X authentication. Disabling dot1x bypasses Network Access Control and can enable unauthorized devices to gain access to internal networks. The detection relies on telemetry that records the relevant Cisco command text, specifically variations of port-control force-authorized and dot1x/global disable commands.
Reporting behind it
- cisco.comhttps://www.cisco.com/en/US/docs/ios-xml/ios/san/command/san-xe-3se-3850-cr-book_chapter_00.html#wp3394428680
- cisco.comhttps://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-xe-3se-3850-cr-book/sec-a1-xe-3se-3850-cr-book_chapter_010.html#wp3502072400
- cisco.comhttps://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_53_se/command/reference/2960ComRef/cli1.html#47220
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_dot1x_disabled.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Cisco Network Device 802.1X (dot1x) Disabled via port-control Force-Authorized
id: 0c4d69d5-6acf-4e41-bf81-9d09eb5788b7
status: experimental
description: This rule matches Cisco AAA/service CLI command strings used to disable IEEE 802.1X (dot1x) on an interface by forcing the port into an authorized state without 802.1X authentication. Disabling dot1x bypasses Network Access Control and can enable unauthorized devices to gain access to internal networks. The detection relies on telemetry that records the relevant Cisco command text, specifically variations of port-control force-authorized and dot1x/global disable commands.
references:
- https://www.cisco.com/en/US/docs/ios-xml/ios/san/command/san-xe-3se-3850-cr-book_chapter_00.html#wp3394428680
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-xe-3se-3850-cr-book/sec-a1-xe-3se-3850-cr-book_chapter_010.html#wp3502072400
- https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_53_se/command/reference/2960ComRef/cli1.html#47220
- https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_dot1x_disabled.yml
author: Luc Génaux, Huntrule Team
date: 2026-04-28
tags:
- attack.persistence
- attack.credential-access
- attack.defense-impairment
- attack.t1685
- attack.t1556.004
logsource:
product: cisco
service: aaa
detection:
keywords:
- access-session port-control force-authorized
- authentication port-control force-authorized
- dot1x port-control force-authorized
- no access-session port-control
- no authentication port-control
- no dot1x port-control
- no dot1x system-auth-control
condition: keywords
falsepositives:
- Administrator troubleshooting connectivity issues
level: medium
license: DRL-1.1
related:
- id: ef0ff092-a24a-4fbc-beea-06c08d53e085
type: derived