{"id":"ef0ff092-a24a-4fbc-beea-06c08d53e085","title":"Cisco Dot1x Disabled","description":"Detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface.\nDisabling dot1x bypasses Network Access Control (NAC) mechanisms, potentially allowing unauthorized devices to gain access to the internal network.\nThis activity is a common technique used by attackers or malicious insiders to establish persistence or perform lateral movement via rogue devices.\n","author":"Luc Génaux","status":"experimental","level":"medium","date":"2026-04-28","modified":"","tags":["attack.persistence","attack.credential-access","attack.defense-impairment","attack.t1685","attack.t1556.004"],"technique_ids":["T1556.004","T1685"],"logsource":{"product":"cisco","service":"aaa"},"falsepositives":["Administrator troubleshooting connectivity issues"],"references":["https://www.cisco.com/en/US/docs/ios-xml/ios/san/command/san-xe-3se-3850-cr-book_chapter_00.html#wp3394428680","https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-xe-3se-3850-cr-book/sec-a1-xe-3se-3850-cr-book_chapter_010.html#wp3502072400","https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_53_se/command/reference/2960ComRef/cli1.html#47220"],"source_path":"rules/network/cisco/aaa/cisco_cli_dot1x_disabled.yml","source_sha256":"489bb5cafbe18019d4e0652ffdbd6422acbbbdeaac0a6fee83d349ec36aca4a3","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/cisco/aaa/cisco_cli_dot1x_disabled.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Cisco Dot1x Disabled\nid: ef0ff092-a24a-4fbc-beea-06c08d53e085\nstatus: experimental\ndescription: |\n    Detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface.\n    Disabling dot1x bypasses Network Access Control (NAC) mechanisms, potentially allowing unauthorized devices to gain access to the internal network.\n    This activity is a common technique used by attackers or malicious insiders to establish persistence or perform lateral movement via rogue devices.\nreferences:\n    - https://www.cisco.com/en/US/docs/ios-xml/ios/san/command/san-xe-3se-3850-cr-book_chapter_00.html#wp3394428680 # Modern IOS-XE\n    - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-xe-3se-3850-cr-book/sec-a1-xe-3se-3850-cr-book_chapter_010.html#wp3502072400 # Older IOS\n    - https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_53_se/command/reference/2960ComRef/cli1.html#47220 # Legacy\nauthor: Luc Génaux\ndate: 2026-04-28\ntags:\n    - attack.persistence\n    - attack.credential-access\n    - attack.defense-impairment\n    - attack.t1685\n    - attack.t1556.004\nlogsource:\n    product: cisco\n    service: aaa\ndetection:\n    keywords:\n        # xxx port-control force-authorized : disables 802.1X authentication and causes the port to change to the authorized state without any authentication exchange required\n        # no xxx port-control : causes the port to fallback to the default setting which is \"force-authorized\", thereby disabling 802.1X\n        - 'access-session port-control force-authorized' # Modern IOS-XE\n        - 'authentication port-control force-authorized' # Older IOS\n        - 'dot1x port-control force-authorized' # Legacy\n        - 'no access-session port-control' # Modern IOS-XE\n        - 'no authentication port-control' # Older IOS\n        - 'no dot1x port-control' # Legacy\n        - 'no dot1x system-auth-control' # disables 802.1X globally\n    condition: keywords\nfalsepositives:\n    - Administrator troubleshooting connectivity issues\nlevel: medium\n# regression_tests_path: regression_data/rules/cisco/aaa/cisco_cli_dot1x_disabled/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1556.004","id":"T1556.004","name":"Network Device Authentication","page":"techniques/enterprise/T1556.004/"},{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/ef0ff092-a24a-4fbc-beea-06c08d53e085.json","kind":"sigma"}