Title:
Cisco Denial of Service
Status:
test
Description:Detect a system being shutdown or put into different boot mode
References:
Author: Austin Clark
Date: 2019-08-15
modified:2023-01-04
Tags:
- -'attack.impact'
- -'attack.t1495'
- -'attack.t1529'
- -'attack.t1565.001'
Logsource:
- product: cisco
- service: aaa
Detection:
keywords:
- 'shutdown'
- 'config-register 0x2100'
- 'config-register 0x2142'
condition:
keywords
Falsepositives:
-Legitimate administrators may run these commands, though rarely.
Level:
medium
