Cisco Clear Logs

Title: Cisco Clear Logs
Status: test
Description:Clear command history in network OS which is used for defense evasion
References:
  -https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/command/reference/sysmgmt/n5k-sysmgmt-cr/n5k-sm_cmds_c.html
  -https://www.cisco.com/c/en/us/td/docs/ios/12_2sr/12_2sra/feature/guide/srmgtint.html#wp1127609
Author: Austin Clark
Date: 2019-08-12
modified:2023-05-26
Tags:

• -'attack.stealth'
• -'attack.t1070.003'

Logsource:

• product: cisco
• service: aaa

Detection:
  keywords:
    - 'clear logging'
    - 'clear archive'
  condition:keywords
Falsepositives:
  -Legitimate administrators may run these commands
Level: high