Cisco Discovery

Title: Cisco Discovery
Status: test
Description:Find information about network devices that is not stored in config files
References:
  -https://www.cisco.com/c/en/us/td/docs/server_nw_virtual/2-5_release/command_reference/show.html
Author: Austin Clark
Date: 2019-08-12
modified:2023-01-04
Tags:

• -'attack.discovery'
• -'attack.t1083'
• -'attack.t1201'
• -'attack.t1057'
• -'attack.t1018'
• -'attack.t1082'
• -'attack.t1016'
• -'attack.t1049'
• -'attack.t1033'
• -'attack.t1124'

Logsource:

• product: cisco
• service: aaa

Detection:
  keywords:
    - 'dir'
    - 'show arp'
    - 'show cdp'
    - 'show clock'
    - 'show ip interface'
    - 'show ip route'
    - 'show ip sockets'
    - 'show processes'
    - 'show ssh'
    - 'show users'
    - 'show version'
  condition:keywords
Falsepositives:
  -Commonly used by administrators for troubleshooting
Level: low