{"id":"6d844f0f-1c18-41af-8f19-33e7654edfc3","title":"Cisco Local Accounts","description":"Find local accounts being created or modified as well as remote authentication configurations","author":"Austin Clark","status":"test","level":"high","date":"2019-08-12","modified":"2023-01-04","tags":["attack.privilege-escalation","attack.persistence","attack.t1136.001","attack.t1098"],"technique_ids":["T1098","T1136.001"],"logsource":{"product":"cisco","service":"aaa"},"falsepositives":["When remote authentication is in place, this should not change often"],"references":[],"source_path":"rules/network/cisco/aaa/cisco_cli_local_accounts.yml","source_sha256":"8dc681bb2d349b6803b32bdd3e24c4bdd37998da40dec46ca29887540b80f587","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/cisco/aaa/cisco_cli_local_accounts.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Cisco Local Accounts\nid: 6d844f0f-1c18-41af-8f19-33e7654edfc3\nstatus: test\ndescription: Find local accounts being created or modified as well as remote authentication configurations\nauthor: Austin Clark\ndate: 2019-08-12\nmodified: 2023-01-04\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.t1136.001\n    - attack.t1098\nlogsource:\n    product: cisco\n    service: aaa\ndetection:\n    keywords:\n        - 'username'\n        - 'aaa'\n    condition: keywords\nfalsepositives:\n    - When remote authentication is in place, this should not change often\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1098","id":"T1098","name":"Account Manipulation","page":"techniques/enterprise/T1098/"},{"key":"enterprise/T1136.001","id":"T1136.001","name":"Local Account","page":"techniques/enterprise/T1136.001/"}],"data_path":"data/detection-rules/6d844f0f-1c18-41af-8f19-33e7654edfc3.json","kind":"sigma"}