Cisco Collect Data

Title: Cisco Collect Data
Status: test
Description:Collect pertinent data from the configuration files
References:
  -https://blog.router-switch.com/2013/11/show-running-config/
  -https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/cmdrefs/show_startup-config.htm
  -https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/config-mgmt/configuration/15-sy/config-mgmt-15-sy-book/cm-config-diff.html
Author: Austin Clark
Date: 2019-08-11
modified:2023-01-04
Tags:

• -'attack.discovery'
• -'attack.credential-access'
• -'attack.collection'
• -'attack.t1087.001'
• -'attack.t1552.001'
• -'attack.t1005'

Logsource:

• product: cisco
• service: aaa

Detection:
  keywords:
    - 'show running-config'
    - 'show startup-config'
    - 'show archive config'
    - 'more'
  condition:keywords
Falsepositives:
  -Commonly run by administrators
Level: low