Techniques
Sample rules
Cisco Discovery
- source: sigma
- technicques:
- t1016
- t1018
- t1033
- t1049
- t1057
- t1082
- t1083
- t1124
- t1201
Description
Find information about network devices that is not stored in config files
Detection logic
condition: keywords
keywords:
- dir
- show arp
- show cdp
- show clock
- show ip interface
- show ip route
- show ip sockets
- show processes
- show ssh
- show users
- show version