Cisco Network OS: Clear Logging Commands Detected (AAA)

Flags Cisco network OS attempts to clear logs or archives via AAA command text.

FreeUnreviewedSigmahighv1

cisco-network-os-clear-logging-commands-detected-aaa-ceb407f6

title: "Cisco Network OS: Clear Logging Commands Detected (AAA)"
id: 1a23fd42-5075-4264-afe6-0c5a2f85648e
status: test
description: This rule identifies Cisco command activity that includes the phrases "clear logging" or "clear archive". Attackers may use log-clearing behavior to reduce evidence and hinder incident response. It relies on AAA-related command/keyword telemetry that captures these specific command strings.
references:
  - https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/command/reference/sysmgmt/n5k-sysmgmt-cr/n5k-sm_cmds_c.html
  - https://www.cisco.com/c/en/us/td/docs/ios/12_2sr/12_2sra/feature/guide/srmgtint.html#wp1127609
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_clear_logs.yml
author: Austin Clark, Huntrule Team
date: 2019-08-12
modified: 2023-05-26
tags:
  - attack.stealth
  - attack.t1070.003
logsource:
  product: cisco
  service: aaa
detection:
  keywords:
    - clear logging
    - clear archive
  condition: keywords
falsepositives:
  - Legitimate administrators may run these commands
level: high
license: DRL-1.1
related:
  - id: ceb407f6-8277-439b-951f-e4210e3ed956
    type: derived

What it detects

This rule identifies Cisco command activity that includes the phrases "clear logging" or "clear archive". Attackers may use log-clearing behavior to reduce evidence and hinder incident response. It relies on AAA-related command/keyword telemetry that captures these specific command strings.

Known false positives

Legitimate administrators may run these commands

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.