Suspicious Cisco File Removal (via aaa)

title: Suspicious Cisco File Removal (via aaa)
id: d6905f8b-aac8-512f-89f9-d695ee868e2f
status: stable
description: This rule detects see what files are being deleted from flash file systems
author: Huntrule Team
date: 2026-06-24
tags:
    - attack.impact
    - attack.stealth
    - attack.t1070.004
    - attack.t1561.001
    - attack.t1561.002
logsource:
    product: cisco
    service: aaa
detection:
    keywords:
        - 'erase'
        - 'delete'
        - 'format'
    condition: keywords
falsepositives:
    - Unknown
level: medium
references:
    - https://attack.mitre.org/techniques/T1561/002/
    - https://attack.mitre.org/techniques/T1561/001/
    - https://attack.mitre.org/techniques/T1070/004/