1200KM / sigma-rule
Cisco Show Commands Input — Sigma Rule
Sigma rule b094d9fb-b1ad-4650-9f1a-fb7be9f1d34b. Cisco Show Commands Input — Sigma Rule. See what commands are being input into the device by other people, full credentials can be in the history
Rule metadata and linked tags
Author: Austin Clark. Source status: test; severity: medium. Source dates: 2019-08-11 / 2023-01-04.
{
"product": "cisco",
"service": "aaa"
}Pinned original Sigma rule · Detection Rule License 1.1
Source SHA-256: 9a6202807e8fd0c8aa3582052fa5a3272952a5a7dd38ea9b1812b60b2786466c
Detection logic
Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.
title: Cisco Show Commands Input
id: b094d9fb-b1ad-4650-9f1a-fb7be9f1d34b
status: test
description: See what commands are being input into the device by other people, full credentials can be in the history
author: Austin Clark
date: 2019-08-11
modified: 2023-01-04
tags:
- attack.credential-access
- attack.t1552.003
logsource:
product: cisco
service: aaa
detection:
keywords:
- 'show history'
- 'show history all'
- 'show logging'
condition: keywords
falsepositives:
- Not commonly run by administrators, especially if remote logging is configured
level: medium
False positives
- Not commonly run by administrators, especially if remote logging is configured
Source references
No reviewed association in this snapshot.
Connected ecosystem references
Exact source-tagged techniques
Telemetry review
Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.