{"id":"671ffc77-50a7-464f-9e3d-9ea2b493b26b","title":"Cisco Modify Configuration","description":"Modifications to a config that will serve an adversary's impacts or persistence","author":"Austin Clark","status":"test","level":"medium","date":"2019-08-12","modified":"2025-04-28","tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.impact","attack.t1490","attack.t1505","attack.t1565.002","attack.t1053"],"technique_ids":["T1053","T1490","T1505","T1565.002"],"logsource":{"product":"cisco","service":"aaa"},"falsepositives":["Legitimate administrators may run these commands"],"references":[],"source_path":"rules/network/cisco/aaa/cisco_cli_modify_config.yml","source_sha256":"e94d03664cdd475c28b191c847699e3ce807a236025c430b96d351b024b5a7a1","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/cisco/aaa/cisco_cli_modify_config.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Cisco Modify Configuration\nid: 671ffc77-50a7-464f-9e3d-9ea2b493b26b\nstatus: test\ndescription: Modifications to a config that will serve an adversary's impacts or persistence\nauthor: Austin Clark\ndate: 2019-08-12\nmodified: 2025-04-28\ntags:\n    - attack.privilege-escalation\n    - attack.execution\n    - attack.persistence\n    - attack.impact\n    - attack.t1490\n    - attack.t1505\n    - attack.t1565.002\n    - attack.t1053\nlogsource:\n    product: cisco\n    service: aaa\ndetection:\n    keywords:\n        - 'ip http server'\n        - 'ip https server'\n        - 'kron policy-list'\n        - 'kron occurrence'\n        - 'policy-list'\n        - 'access-list'\n        - 'ip access-group'\n        - 'archive maximum'\n        - 'ntp server'\n    condition: keywords\nfalsepositives:\n    - Legitimate administrators may run these commands\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1053","id":"T1053","name":"Scheduled Task/Job","page":"techniques/enterprise/T1053/"},{"key":"enterprise/T1490","id":"T1490","name":"Inhibit System Recovery","page":"techniques/enterprise/T1490/"},{"key":"enterprise/T1505","id":"T1505","name":"Server Software Component","page":"techniques/enterprise/T1505/"},{"key":"enterprise/T1565.002","id":"T1565.002","name":"Transmitted Data Manipulation","page":"techniques/enterprise/T1565.002/"}],"data_path":"data/detection-rules/671ffc77-50a7-464f-9e3d-9ea2b493b26b.json","kind":"sigma"}