Nasreddine Bencherchali
598d29f811
chore: change tags, date, modified fields to comply with v2 of the Sigma spec. chore: update the related type from `obsoletes` to `obsolete`. chore: update local json schema to the latest version.
25 lines
759 B
YAML
25 lines
759 B
YAML
title: Cisco Clear Logs
|
|
id: ceb407f6-8277-439b-951f-e4210e3ed956
|
|
status: test
|
|
description: Clear command history in network OS which is used for defense evasion
|
|
references:
|
|
- https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/command/reference/sysmgmt/n5k-sysmgmt-cr/n5k-sm_cmds_c.html
|
|
- https://www.cisco.com/c/en/us/td/docs/ios/12_2sr/12_2sra/feature/guide/srmgtint.html#wp1127609
|
|
author: Austin Clark
|
|
date: 2019-08-12
|
|
modified: 2023-05-26
|
|
tags:
|
|
- attack.defense-evasion
|
|
- attack.t1070.003
|
|
logsource:
|
|
product: cisco
|
|
service: aaa
|
|
detection:
|
|
keywords:
|
|
- 'clear logging'
|
|
- 'clear archive'
|
|
condition: keywords
|
|
falsepositives:
|
|
- Legitimate administrators may run these commands
|
|
level: high
|