Suspicious Cisco Show Commands Input (via aaa)

title: Suspicious Cisco Show Commands Input (via aaa)
id: 9088a90b-064d-552f-b977-f6b3eadc46e5
status: stable
description: This rule detects see what commands are being input into the device by other people, full credentials can be in the history
author: Huntrule Team
date: 2026-06-22
tags:
    - attack.credential-access
    - attack.t1552.003
logsource:
    product: cisco
    service: aaa
detection:
    keywords:
        - 'show history'
        - 'show history all'
        - 'show logging'
    condition: keywords
falsepositives:
    - Unknown
level: medium
references:
    - https://attack.mitre.org/techniques/T1552/003/