Sunturai
Back to results
InformationalSplunk security contentNasreddine Bencherchali

Cisco IOS XE Reconnaissance Command Activity

This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. Adversaries who gain initial access to network infrastructure devices typically perform systematic…

Description

This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. Adversaries who gain initial access to network infrastructure devices typically perform systematic reconnaissance to understand the device configuration, network topology, security policies, connected systems, and potential attack paths. This reconnaissance phase involves executing multiple "show" commands to enumerate device details, running configurations, active connections, routing information, and VPN sessions.

Detection logic

Detection requirements

Platform
ESXiIaaSLinuxmacOSNetwork DevicesPREWindows

The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.

Log source category
cisco_ios_logs

Known benign triggers

  • Network audits and troubleshooting can produce similar command bursts. Tune the command list, threshold, and approved administrators for the environment.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice