Suspicious Disabling of Cisco Dot1x (via aaa)

title: Suspicious Disabling of Cisco Dot1x (via aaa)
id: 1cb54122-45a0-535d-a932-70a0d21019c8
status: stable
description: This rule detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface. Disabling dot1x bypasses Network Access Control (NAC) mechanisms, potentially allowing unauthorized devices to gain access to the internal network. This behavior is a common method used by adversaries or hostile insiders to establish persistence or perform lateral movement via rogue devices.
references:
    - https://attack.mitre.org/techniques/T1556/004/
    - https://attack.mitre.org/techniques/T1685/
    - https://www.cisco.com/en/US/docs/ios-xml/ios/san/command/san-xe-3se-3850-cr-book_chapter_00.html#wp3394428680
    - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-xe-3se-3850-cr-book/sec-a1-xe-3se-3850-cr-book_chapter_010.html#wp3502072400
    - https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_53_se/command/reference/2960ComRef/cli1.html#47220
author: Huntrule Team
date: 2026-05-20
tags:
    - attack.persistence
    - attack.credential-access
    - attack.defense-impairment
    - attack.t1685
    - attack.t1556.004
logsource:
    product: cisco
    service: aaa
detection:
    keywords:
        - 'access-session port-control force-authorized'
        - 'authentication port-control force-authorized'
        - 'dot1x port-control force-authorized'
        - 'no access-session port-control'
        - 'no authentication port-control'
        - 'no dot1x port-control'
        - 'no dot1x system-auth-control'
    condition: keywords
falsepositives:
    - Unknown
level: medium