title: Cisco Stage Data
id: 5e51acb2-bcbe-435b-99c6-0e3cd5e2aa59
status: test
description: Various protocols maybe used to put data on the device for exfil or infil
author: Austin Clark
date: 2019/08/12
modified: 2021/11/27
logsource:
  product: cisco
  service: aaa
  category: accounting
detection:
  keywords:
    - 'tftp'
    - 'rcp'
    - 'puts'
    - 'copy'
    - 'configure replace'
    - 'archive tar'
  condition: keywords
fields:
  - CmdSet
falsepositives:
  - Generally used to copy configs or IOS images
level: low
tags:
  - attack.collection
  - attack.lateral_movement
  - attack.command_and_control
  - attack.exfiltration
  - attack.t1074
  - attack.t1105
  - attack.t1560.001
