SigmaHQ/rules/network/cisco/aaa/cisco_cli_clear_logs.yml

34 lines
775 B
YAML

title: Cisco Clear Logs
id: ceb407f6-8277-439b-951f-e4210e3ed956
status: experimental
description: Clear command history in network OS which is used for defense evasion.
references:
- https://attack.mitre.org/techniques/T1146/
- https://attack.mitre.org/techniques/T1070/
author: Austin Clark
date: 2019/08/12
tags:
- attack.defense_evasion
- attack.t1146
- attack.t1070
- attack.t1070.003
- attack.t1070
logsource:
product: cisco
service: aaa
category: accounting
fields:
- src
- CmdSet
- User
- Privilege_Level
- Remote_Address
detection:
keywords:
- 'clear logging'
- 'clear archive'
condition: keywords
falsepositives:
- Legitimate administrators may run these commands.
level: high