Cisco File Deletion

Title: Cisco File Deletion
Status: test
Description:See what files are being deleted from flash file systems
References:
Author: Austin Clark
Date: 2019-08-12
modified:2023-01-04
Tags:

• -'attack.impact'
• -'attack.stealth'
• -'attack.t1070.004'
• -'attack.t1561.001'
• -'attack.t1561.002'

Logsource:

• product: cisco
• service: aaa

Detection:
  keywords:
    - 'erase'
    - 'delete'
    - 'format'
  condition:keywords
Falsepositives:
  -Will be used sometimes by admins to clean up local flash space
Level: medium