Cisco Crypto Commands

Title: Cisco Crypto Commands
Status: test
Description:Show when private keys are being exported from the device, or when new certificates are installed
References:
  -https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-cr-book/sec-a1-cr-book_chapter_0111.html
Author: Austin Clark
Date: 2019-08-12
modified:2023-01-04
Tags:

• -'attack.credential-access'
• -'attack.defense-impairment'
• -'attack.t1553.004'
• -'attack.t1552.004'

Logsource:

• product: cisco
• service: aaa

Detection:
  keywords:
    - 'crypto pki export'
    - 'crypto pki import'
    - 'crypto pki trustpoint'
  condition:keywords
Falsepositives:
  -Not commonly run by administrators. Also whitelist your known good certificates
Level: high