LoFP / legitimate administrators may run these commands, though rarely.

Techniques

• t1495
• t1529
• t1565
• t1565.001

Sample rules

Cisco Denial of Service

• source: sigma
• technicques:
  • t1495
  • t1529
  • t1565
  • t1565.001

Description

Detect a system being shutdown or put into different boot mode

Detection logic

condition: keywords
keywords:
- shutdown
- config-register 0x2100
- config-register 0x2142