Cisco IOS XE Web UI Exploitation Indicators for CVE-2023-20198 via Syslog Login and Config Events
Matches Cisco IOS XE Web UI and web login success logs consistent with CVE-2023-20198 exploitation using specified admin/TAC usernames.
- Product
- cisco
- Service
- syslog
- Author
- Lars B. P. Frydenskov (Trifork Security) (SigmaHQ), DRL 1.1
- Published
- 2023-10-20
- Updated
- 2026-07-31
What it detects
This rule flags likely exploitation activity for the Cisco IOS XE Web UI privilege escalation vulnerability by matching specific Cisco syslog messages combined with successful web login context. It focuses on events that include Web UI install operation information and configuration-related syslog entries alongside successful web logins for privileged Cisco-related accounts. The detection relies on Cisco IOS XE syslog telemetry where these message strings and usernames are present.
Reporting behind it
- sec.cloudapps.cisco.comhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z
- thestack.technologyhttps://www.thestack.technology/security-experts-call-for-incident-response-exercises-after-mass-cisco-device-exploitation/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-20198/cisco_syslog_cve_2023_20198_ios_xe_web_ui.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Cisco IOS XE Web UI Exploitation Indicators for CVE-2023-20198 via Syslog Login and Config Events
id: 2c3ef879-ff0d-4256-9b0c-43518db0eb74
status: test
description: This rule flags likely exploitation activity for the Cisco IOS XE Web UI privilege escalation vulnerability by matching specific Cisco syslog messages combined with successful web login context. It focuses on events that include Web UI install operation information and configuration-related syslog entries alongside successful web logins for privileged Cisco-related accounts. The detection relies on Cisco IOS XE syslog telemetry where these message strings and usernames are present.
references:
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z
- https://www.thestack.technology/security-experts-call-for-incident-response-exercises-after-mass-cisco-device-exploitation/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-20198/cisco_syslog_cve_2023_20198_ios_xe_web_ui.yml
author: Lars B. P. Frydenskov (Trifork Security), Huntrule Team
date: 2023-10-20
tags:
- attack.privilege-escalation
- attack.initial-access
- detection.emerging-threats
logsource:
product: cisco
service: syslog
definition: "Requirements: Cisco IOS XE system logs needs to be configured and ingested"
detection:
keyword_event:
- "%WEBUI-6-INSTALL_OPERATION_INFO:"
- "%SYS-5-CONFIG_P:"
- "%SEC_LOGIN-5-WEBLOGIN_SUCCESS:"
keyword_user:
- cisco_tac_admin
- cisco_support
- cisco_sys_manager
condition: keyword_event and keyword_user
falsepositives:
- Rare false positives might occur if there are valid users named "cisco_tac_admin" or "cisco_support", which are not created by default or CISCO representatives
level: high
license: DRL-1.1
related:
- id: 2ece8816-b7a0-4d9b-b0e8-ae7ad18bc02b
type: derived