{"id":"cd072b25-a418-4f98-8ebc-5093fb38fe1a","title":"Cisco Collect Data","description":"Collect pertinent data from the configuration files","author":"Austin Clark","status":"test","level":"low","date":"2019-08-11","modified":"2023-01-04","tags":["attack.discovery","attack.credential-access","attack.collection","attack.t1087.001","attack.t1552.001","attack.t1005"],"technique_ids":["T1005","T1087.001","T1552.001"],"logsource":{"product":"cisco","service":"aaa"},"falsepositives":["Commonly run by administrators"],"references":["https://blog.router-switch.com/2013/11/show-running-config/","https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/cmdrefs/show_startup-config.htm","https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/config-mgmt/configuration/15-sy/config-mgmt-15-sy-book/cm-config-diff.html"],"source_path":"rules/network/cisco/aaa/cisco_cli_collect_data.yml","source_sha256":"7ff98f800a0db990ed4d2e2f2ec0fb6934e696760a67f0e2897798e1dd8e4a53","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/cisco/aaa/cisco_cli_collect_data.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Cisco Collect Data\nid: cd072b25-a418-4f98-8ebc-5093fb38fe1a\nstatus: test\ndescription: Collect pertinent data from the configuration files\nreferences:\n    - https://blog.router-switch.com/2013/11/show-running-config/\n    - https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/cmdrefs/show_startup-config.htm\n    - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/config-mgmt/configuration/15-sy/config-mgmt-15-sy-book/cm-config-diff.html\nauthor: Austin Clark\ndate: 2019-08-11\nmodified: 2023-01-04\ntags:\n    - attack.discovery\n    - attack.credential-access\n    - attack.collection\n    - attack.t1087.001\n    - attack.t1552.001\n    - attack.t1005\nlogsource:\n    product: cisco\n    service: aaa\ndetection:\n    keywords:\n        - 'show running-config'\n        - 'show startup-config'\n        - 'show archive config'\n        - 'more'\n    condition: keywords\nfalsepositives:\n    - Commonly run by administrators\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1005","id":"T1005","name":"Data from Local System","page":"techniques/enterprise/T1005/"},{"key":"enterprise/T1087.001","id":"T1087.001","name":"Local Account","page":"techniques/enterprise/T1087.001/"},{"key":"enterprise/T1552.001","id":"T1552.001","name":"Credentials In Files","page":"techniques/enterprise/T1552.001/"}],"data_path":"data/detection-rules/cd072b25-a418-4f98-8ebc-5093fb38fe1a.json","kind":"sigma"}