Cisco Stage Data

Title: Cisco Stage Data
Status: test
Description:Various protocols maybe used to put data on the device for exfil or infil
References:
Author: Austin Clark
Date: 2019-08-12
modified:2023-01-04
Tags:

• -'attack.collection'
• -'attack.lateral-movement'
• -'attack.command-and-control'
• -'attack.exfiltration'
• -'attack.t1074'
• -'attack.t1105'
• -'attack.t1560.001'

Logsource:

• product: cisco
• service: aaa

Detection:
  keywords:
    - 'tftp'
    - 'rcp'
    - 'puts'
    - 'copy'
    - 'configure replace'
    - 'archive tar'
  condition:keywords
Falsepositives:
  -Generally used to copy configs or IOS images
Level: low