{"id":"d94a35f0-7a29-45f6-90a0-80df6159967c","title":"Cisco Denial of Service","description":"Detect a system being shutdown or put into different boot mode","author":"Austin Clark","status":"test","level":"medium","date":"2019-08-15","modified":"2023-01-04","tags":["attack.impact","attack.t1495","attack.t1529","attack.t1565.001"],"technique_ids":["T1495","T1529","T1565.001"],"logsource":{"product":"cisco","service":"aaa"},"falsepositives":["Legitimate administrators may run these commands, though rarely."],"references":[],"source_path":"rules/network/cisco/aaa/cisco_cli_dos.yml","source_sha256":"9dbea36cad0eb20c49ec340dd2f9dea375266ea154610b6e845503b19980690d","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/cisco/aaa/cisco_cli_dos.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Cisco Denial of Service\nid: d94a35f0-7a29-45f6-90a0-80df6159967c\nstatus: test\ndescription: Detect a system being shutdown or put into different boot mode\nauthor: Austin Clark\ndate: 2019-08-15\nmodified: 2023-01-04\ntags:\n    - attack.impact\n    - attack.t1495\n    - attack.t1529\n    - attack.t1565.001\nlogsource:\n    product: cisco\n    service: aaa\ndetection:\n    keywords:\n        - 'shutdown'\n        - 'config-register 0x2100'\n        - 'config-register 0x2142'\n    condition: keywords\nfalsepositives:\n    - Legitimate administrators may run these commands, though rarely.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1495","id":"T1495","name":"Firmware Corruption","page":"techniques/enterprise/T1495/"},{"key":"enterprise/T1529","id":"T1529","name":"System Shutdown/Reboot","page":"techniques/enterprise/T1529/"},{"key":"enterprise/T1565.001","id":"T1565.001","name":"Stored Data Manipulation","page":"techniques/enterprise/T1565.001/"}],"data_path":"data/detection-rules/d94a35f0-7a29-45f6-90a0-80df6159967c.json","kind":"sigma"}