Possible Cisco Enumeration (via aaa)

title: Possible Cisco Enumeration (via aaa)
id: f66597b4-b813-5dfd-b51c-26adc81f78c6
status: stable
description: This rule detects information about network devices that is not stored in config files
references:
    - https://attack.mitre.org/techniques/T1124/
    - https://attack.mitre.org/techniques/T1033/
    - https://attack.mitre.org/techniques/T1049/
    - https://attack.mitre.org/techniques/T1016/
    - https://attack.mitre.org/techniques/T1082/
    - https://attack.mitre.org/techniques/T1018/
    - https://attack.mitre.org/techniques/T1057/
    - https://attack.mitre.org/techniques/T1201/
    - https://attack.mitre.org/techniques/T1083/
    - https://www.cisco.com/c/en/us/td/docs/server_nw_virtual/2-5_release/command_reference/show.html
author: Huntrule Team
date: 2026-04-20
tags:
    - attack.discovery
    - attack.t1083
    - attack.t1201
    - attack.t1057
    - attack.t1018
    - attack.t1082
    - attack.t1016
    - attack.t1049
    - attack.t1033
    - attack.t1124
logsource:
    product: cisco
    service: aaa
detection:
    keywords:
        - 'dir'
        - 'show arp'
        - 'show cdp'
        - 'show clock'
        - 'show ip interface'
        - 'show ip route'
        - 'show ip sockets'
        - 'show processes'
        - 'show ssh'
        - 'show users'
        - 'show version'
    condition: keywords
falsepositives:
    - Unknown
level: low