Cisco IOS XE Web UI exploitation indicators for CVE-2023-20198

title: Cisco IOS XE Web UI exploitation indicators for CVE-2023-20198
id: 2c3ef879-ff0d-4256-9b0c-43518db0eb74
status: test
description: This rule flags potential exploitation activity targeting privilege escalation via the Cisco IOS XE Web UI by matching specific web UI, configuration, and successful login log messages. It also requires the username to be one of the Cisco TAC/admin accounts listed, which helps focus on sessions consistent with the reported exploitation pattern. The detection relies on Cisco IOS XE syslog telemetry containing the configured keywords and the associated web login success event.
references:
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z
  - https://www.thestack.technology/security-experts-call-for-incident-response-exercises-after-mass-cisco-device-exploitation/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-20198/cisco_syslog_cve_2023_20198_ios_xe_web_ui.yml
author: Lars B. P. Frydenskov (Trifork Security), Huntrule Team
date: 2023-10-20
tags:
  - attack.privilege-escalation
  - attack.initial-access
  - detection.emerging-threats
logsource:
  product: cisco
  service: syslog
  definition: "Requirements: Cisco IOS XE system logs needs to be configured and ingested"
detection:
  keyword_event:
    - "%WEBUI-6-INSTALL_OPERATION_INFO:"
    - "%SYS-5-CONFIG_P:"
    - "%SEC_LOGIN-5-WEBLOGIN_SUCCESS:"
  keyword_user:
    - cisco_tac_admin
    - cisco_support
    - cisco_sys_manager
  condition: keyword_event and keyword_user
falsepositives:
  - Rare false positives might occur if there are valid users named "cisco_tac_admin" or "cisco_support", which are not created by default or CISCO representatives
level: high
license: DRL-1.1
related:
  - id: 2ece8816-b7a0-4d9b-b0e8-ae7ad18bc02b
    type: derived