Title:
Cisco Local Accounts
Status:
test
Description:Find local accounts being created or modified as well as remote authentication configurations
References:
Author: Austin Clark
Date: 2019-08-12
modified:2023-01-04
Tags:
- -'attack.privilege-escalation'
- -'attack.persistence'
- -'attack.t1136.001'
- -'attack.t1098'
Logsource:
- product: cisco
- service: aaa
Detection:
keywords:
- 'username'
- 'aaa'
condition:
keywords
Falsepositives:
-When remote authentication is in place, this should not change often
Level:
high
