Cisco Modify Configuration

Title: Cisco Modify Configuration
Status: test
Description:Modifications to a config that will serve an adversary's impacts or persistence
References:
Author: Austin Clark
Date: 2019-08-12
modified:2025-04-28
Tags:

• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.persistence'
• -'attack.impact'
• -'attack.t1490'
• -'attack.t1505'
• -'attack.t1565.002'
• -'attack.t1053'

Logsource:

• product: cisco
• service: aaa

Detection:
  keywords:
    - 'ip http server'
    - 'ip https server'
    - 'kron policy-list'
    - 'kron occurrence'
    - 'policy-list'
    - 'access-list'
    - 'ip access-group'
    - 'archive maximum'
    - 'ntp server'
  condition:keywords
Falsepositives:
  -Legitimate administrators may run these commands
Level: medium