Title:
Cisco Show Commands Input
Status:
test
Description:See what commands are being input into the device by other people, full credentials can be in the history
References:
Author: Austin Clark
Date: 2019-08-11
modified:2023-01-04
Tags:
- -'attack.credential-access'
- -'attack.t1552.003'
Logsource:
- product: cisco
- service: aaa
Detection:
keywords:
- 'show history'
- 'show history all'
- 'show logging'
condition:
keywords
Falsepositives:
-Not commonly run by administrators, especially if remote logging is configured
Level:
medium
