{"id":"9705a6a1-6db6-4a16-a987-15b7151e299b","title":"Cisco Discovery","description":"Find information about network devices that is not stored in config files","author":"Austin Clark","status":"test","level":"low","date":"2019-08-12","modified":"2023-01-04","tags":["attack.discovery","attack.t1083","attack.t1201","attack.t1057","attack.t1018","attack.t1082","attack.t1016","attack.t1049","attack.t1033","attack.t1124"],"technique_ids":["T1016","T1018","T1033","T1049","T1057","T1082","T1083","T1124","T1201"],"logsource":{"product":"cisco","service":"aaa"},"falsepositives":["Commonly used by administrators for troubleshooting"],"references":["https://www.cisco.com/c/en/us/td/docs/server_nw_virtual/2-5_release/command_reference/show.html"],"source_path":"rules/network/cisco/aaa/cisco_cli_discovery.yml","source_sha256":"caaf3675e5ff8db73bd2525f340d7e992209401a7e5f13dd34014d4b3f8cefb5","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/cisco/aaa/cisco_cli_discovery.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Cisco Discovery\nid: 9705a6a1-6db6-4a16-a987-15b7151e299b\nstatus: test\ndescription: Find information about network devices that is not stored in config files\nreferences:\n    - https://www.cisco.com/c/en/us/td/docs/server_nw_virtual/2-5_release/command_reference/show.html\nauthor: Austin Clark\ndate: 2019-08-12\nmodified: 2023-01-04\ntags:\n    - attack.discovery\n    - attack.t1083\n    - attack.t1201\n    - attack.t1057\n    - attack.t1018\n    - attack.t1082\n    - attack.t1016\n    - attack.t1049\n    - attack.t1033\n    - attack.t1124\nlogsource:\n    product: cisco\n    service: aaa\ndetection:\n    keywords:\n        - 'dir'\n        - 'show arp'\n        - 'show cdp'\n        - 'show clock'\n        - 'show ip interface'\n        - 'show ip route'\n        - 'show ip sockets'\n        - 'show processes'\n        - 'show ssh'\n        - 'show users'\n        - 'show version'\n    condition: keywords\nfalsepositives:\n    - Commonly used by administrators for troubleshooting\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1016","id":"T1016","name":"System Network Configuration Discovery","page":"techniques/enterprise/T1016/"},{"key":"enterprise/T1018","id":"T1018","name":"Remote System Discovery","page":"techniques/enterprise/T1018/"},{"key":"enterprise/T1033","id":"T1033","name":"System Owner/User Discovery","page":"techniques/enterprise/T1033/"},{"key":"enterprise/T1049","id":"T1049","name":"System Network Connections Discovery","page":"techniques/enterprise/T1049/"},{"key":"enterprise/T1057","id":"T1057","name":"Process Discovery","page":"techniques/enterprise/T1057/"},{"key":"enterprise/T1082","id":"T1082","name":"System Information Discovery","page":"techniques/enterprise/T1082/"},{"key":"enterprise/T1083","id":"T1083","name":"File and Directory Discovery","page":"techniques/enterprise/T1083/"},{"key":"enterprise/T1124","id":"T1124","name":"System Time Discovery","page":"techniques/enterprise/T1124/"},{"key":"enterprise/T1201","id":"T1201","name":"Password Policy Discovery","page":"techniques/enterprise/T1201/"}],"data_path":"data/detection-rules/9705a6a1-6db6-4a16-a987-15b7151e299b.json","kind":"sigma"}