title: Cisco Local Accounts
id: 6d844f0f-1c18-41af-8f19-33e7654edfc3
status: test
description: Find local accounts being created or modified as well as remote authentication configurations
author: Austin Clark
date: 2019/08/12
modified: 2021/11/27
logsource:
  product: cisco
  service: aaa
  category: accounting
detection:
  keywords:
    - 'username'
    - 'aaa'
  condition: keywords
fields:
  - CmdSet
falsepositives:
  - When remote authentication is in place, this should not change often
level: high
tags:
  - attack.persistence
  - attack.t1136.001
  - attack.t1098
