Vendor advisory

www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a

https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a

Published on: www.cisa.gov

ATT&CK techniques those detections carry

T1021.004SSH
T1078Valid Accounts
T1059Command and Scripting Interpreter
T1190Exploit Public-Facing Application
T1136Create Account
T1562Impair Defenses
T1016System Network Configuration Discovery
T1018Remote System Discovery
+9 more

14 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
Detection	Severity	Source	Published	Licence
Cisco IOS XE WebUI Programmatic Configuration	Informational	Splunk security content	Sep 22, 2026	Apache License 2.0
Cisco Secure Firewall - SSH Connection to sshd_operns	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Cisco Secure Firewall - SSH Connection to Non-Standard Port	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Cisco Secure Firewall - Privileged Command Execution via HTTP	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Cisco Privileged Account Creation with Suspicious SSH Activity	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Cisco Privileged Account Creation with HTTP Command Execution	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Cisco IOS XE WebUI Login From IOSd Local Port	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Cisco IOS XE VTY Access Class Tampering	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Cisco IOS XE Tunnel Interface Configuration	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Cisco IOS XE Request Platform Package Describe Shell Pattern	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Cisco IOS XE Remote Access Probe Burst	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Cisco IOS XE Reconnaissance Command Activity	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Cisco IOS XE Log Clearing Sequence With Optional Loopback Removal	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Cisco IOS XE Guestshell Activation and Destroy	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0

Showing 14 of 14

Filter in the catalogue