network:device
Network device logs (syslog, CLI/AAA, config, SNMP)
- Host type
- Network devices and network sensors
- Tier, as a whole
- Minimum
- Techniques
- 70
- Rules listed
- 245
- Events
- 0
Why this tier
CISA/ASD priority source; OMB M-26-14 A5 (Infrastructure changes; our analysis)
Standards and guidance naming this source
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Infrastructure changes | Supports an activity | our analysis: configuration changes |
| ASD ACSC / CISA et al.: Priority enterprise log sources | priority_source | quoted: edge devices, such as boundary routers and firewalls |
Techniques
- T1005 Data from Local System
- T1006 Direct Volume Access
- T1016 System Network Configuration Discovery
- T1018 Remote System Discovery
- T1020.001 Traffic Duplication
- T1033 System Owner/User Discovery
- T1037 Boot or Logon Initialization Scripts
- T1037.004 RC Scripts
- T1040 Network Sniffing
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1049 System Network Connections Discovery
- T1056.001 Keylogging
- T1057 Process Discovery
- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1059.008 Network Device CLI
- T1059.011 Lua
- T1070.003 Clear Command History
- T1070.007 Clear Network Connection History and Configurations
- T1070.010 Relocate Malware
- T1072 Software Deployment Tools
- T1078.001 Default Accounts
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1090 Proxy
- T1090.001 Internal Proxy
- T1090.002 External Proxy
- T1090.003 Multi-hop Proxy
- T1098.004 SSH Authorized Keys
- T1105 Ingress Tool Transfer
- T1110.001 Password Guessing
- T1110.002 Password Cracking
- T1110.003 Password Spraying
- T1110.004 Credential Stuffing
- T1124 System Time Discovery
- T1136.001 Local Account
- T1190 Exploit Public-Facing Application
- T1201 Password Policy Discovery
- T1205 Traffic Signaling
- T1205.001 Port Knocking
- T1490 Inhibit System Recovery
- T1495 Firmware Corruption
- T1529 System Shutdown/Reboot
- T1542 Pre-OS Boot
- T1542.001 System Firmware
- T1542.002 Component Firmware
- T1542.004 ROMMONkit
- T1542.005 TFTP Boot
- T1552.004 Private Keys
- T1556.004 Network Device Authentication
- T1557 Adversary-in-the-Middle
- T1557.004 Evil Twin
- T1561 Disk Wipe
- T1561.001 Disk Content Wipe
- T1561.002 Disk Structure Wipe
- T1566.004 Spearphishing Voice
- T1599 Network Boundary Bridging
- T1599.001 Network Address Translation Traversal
- T1600 Weaken Encryption
- T1600.001 Reduce Key Space
- T1600.002 Disable Crypto Hardware
- T1601 Modify System Image
- T1601.001 Patch System Image
- T1601.002 Downgrade System Image
- T1602 Data from Configuration Repository
- T1602.001 SNMP (MIB Dump)
- T1602.002 Network Device Configuration Dump
- T1685 Disable or Modify Tools
- T1686 Disable or Modify System Firewall
- T1690 Prevent Command History Logging
Rules
Splunk 43
- Cisco AI Defense Allowed Sensitive Prompt
- Cisco AI Defense Allowed Sensitive Response
- Cisco AI Defense Repeated High Risk Activity
- Cisco AI Defense Security Alerts by Application Name
- Cisco Configuration Archive Logging Analysis
- Cisco IOS Suspicious Privileged Account Creation
- Cisco IOS XE Guestshell Activation and Destroy
- Cisco IOS XE Log Clearing Sequence With Optional Loopback Removal
- Cisco IOS XE Reconnaissance Command Activity
- Cisco IOS XE Remote Access Probe Burst
- Cisco IOS XE Request Platform Package Describe Shell Pattern
- Cisco IOS XE Tunnel Interface Configuration
- Cisco IOS XE VTY Access Class Tampering
- Cisco IOS XE WebUI Login From IOSd Local Port
- Cisco IOS XE WebUI Programmatic Configuration
- Cisco Isovalent - Access To Cloud Metadata Service
- Cisco Isovalent - Cron Job Creation
- Cisco Isovalent - Curl Execution With Insecure Flags
- Cisco Isovalent - Kprobe Spike
- Cisco Isovalent - Late Process Execution
- Cisco Isovalent - Non Allowlisted Image Use
- Cisco Isovalent - Nsenter Usage in Kubernetes Pod
- Cisco Isovalent - Pods Running Offensive Tools
- Cisco Isovalent - Potential Escape to Host
- Cisco Isovalent - Shell Execution
- Cisco Network Interface Modifications
- Cisco SD-WAN - Low Frequency Rogue Peer
- Cisco SD-WAN - Peering Activity
- Cisco SD-WAN Multiple SSH key Authentication from Same Source
- Cisco SD-WAN Multiple Source IP vManage Admin SSH Authentication
- Cisco SNMP Community String Configuration Changes
- Cisco TFTP Server Configuration for Data Exfiltration
- Detect ARP Poisoning
- Detect IPv6 Network Infrastructure Threats
- Detect Port Security Violation
- Detect Rogue DHCP Server
- Detect Traffic Mirroring
- Ivanti VTM New Account Creation
- Linux APT Privilege Escalation
- Linux Add User Account
- Linux Crontab Enumeration
- Linux Curl Upload File
- Linux Decode Base64 to Shell
Sigma 28
- Cisco BGP Authentication Failures by Tim Brown
- Cisco Clear Logs by Austin Clark
- Cisco Collect Data by Austin Clark
- Cisco Crypto Commands by Austin Clark
- Cisco Denial of Service by Austin Clark
- Cisco Disabling Logging by Austin Clark
- Cisco Discovery by Austin Clark
- Cisco Dot1x Disabled by Luc Génaux
- Cisco Duo Successful MFA Authentication Via Bypass Code by Nikita Khalimonenkov
- Cisco File Deletion by Austin Clark
- Cisco LDP Authentication Failures by Tim Brown
- Cisco Local Accounts by Austin Clark
- Cisco Modify Configuration by Austin Clark
- Cisco Show Commands Input by Austin Clark
- Cisco Sniffing by Austin Clark
- Cisco Stage Data by Austin Clark
- Exploitation Indicators Of CVE-2023-20198 by Lars B. P. Frydenskov (Trifork Security)
- FortiGate - Firewall Address Object Added by Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
- FortiGate - New Administrator Account Created by Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
- FortiGate - New Firewall Policy Added by Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
- FortiGate - New Local User Created by Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
- FortiGate - New VPN SSL Web Portal Added by Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
- FortiGate - User Group Modified by Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
- FortiGate - VPN SSL Settings Modified by Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
- Huawei BGP Authentication Failures by Tim Brown
- Juniper BGP Missing MD5 by Tim Brown
- Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection by Nasreddine Bencherchali (Nextron Systems)
- Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection - File Creation by Andreas Braathen (mnemonic.io)
Microsoft Sentinel 174
- A client made a web request to a potentially harmful file (ASIM Web Session schema)
- A host is potentially running PowerShell to send HTTP(S) requests (ASIM Web Session schema)
- A host is potentially running a crypto miner (ASIM Web Session schema)
- A host is potentially running a hacking tool (ASIM Web Session schema)
- Acronis - Login from Abnormal IP - Low Occurrence
- Acronis - Multiple Endpoints Accessing Malicious URLs
- Acronis - Multiple Endpoints Infected by Ransomware
- Acronis - Multiple Inboxes with Malicious Content Detected
- Anomaly found in Network Session Traffic (ASIM Network Session schema)
- ApexOne - Attack Discovery Detection
- ApexOne - C&C callback events
- ApexOne - Commands in Url
- ApexOne - Device access permissions was changed
- ApexOne - Inbound remote access connection
- ApexOne - Multiple deny or terminate actions on single IP
- ApexOne - Possible exploit or execute operation
- ApexOne - Spyware with failed response
- ApexOne - Suspicious commandline arguments
- ApexOne - Suspicious connections
- Awake Security - High Match Counts By Device
- Awake Security - High Severity Matches By Device
- Awake Security - Model With Multiple Destinations
- Cisco - firewall block but success logon to Microsoft Entra ID
- Cisco ASA - average attack detection rate increase
- Cisco ASA - threat detection message fired
- Cisco SEG - DLP policy violation
- Cisco SEG - Malicious attachment not blocked
- Cisco SEG - Multiple large emails sent to external recipient
- Cisco SEG - Multiple suspiciuos attachments received
- Cisco SEG - Possible outbreak
- Cisco SEG - Potential phishing link
- Cisco SEG - Suspicious link
- Cisco SEG - Suspicious sender domain
- Cisco SEG - Unexpected attachment
- Cisco SEG - Unexpected link
- Cisco SEG - Unscannable attacment
- Claroty - Asset Down
- Claroty - Critical baseline deviation
- Claroty - Login to uncommon location
- Claroty - Multiple failed logins by user
- Claroty - Multiple failed logins to same destinations
- Claroty - New Asset
- Claroty - Policy violation
- Claroty - Suspicious activity
- Claroty - Suspicious file transfer
- Claroty - Threat detected
- Common Event Format (CEF) via AMA - Critical Severity Detection
- Common Event Format (CEF) via AMA - Critical or High Severity Detections by User
- Contrast Blocks
- Contrast Exploits
- Contrast Probes
- Contrast Suspicious
- Create Incidents from IronDefense
- CreepyDrive URLs
- CreepyDrive request URL sequence
- Critical Risks
- DNS events related to mining pools (ASIM DNS Schema)
- Detect Malicious Usage of Recovery Tools to Delete Backup Files
- Detect Print Processors Registry Driver Key Creation/Modification
- Detect Registry Run Key Creation/Modification
- Detect Windows Allow Firewall Rule Addition/Modification
- Detect Windows Update Disabled from Registry
- Detect port misuse by anomaly based detection (ASIM Network Session schema)
- Detect port misuse by static threshold (ASIM Network Session schema)
- Discord CDN Risky File Download (ASIM Web Session Schema)
- Dragos Notifications
- Europium - Hash and IP IOCs - September 2022
- Excessive NXDOMAIN DNS Queries (ASIM DNS Schema)
- Excessive number of HTTP authentication failures from a source (ASIM Web Session schema)
- Excessive number of failed connections from a single source (ASIM Network Session schema)
- GreyNoise TI Map IP Entity to CommonSecurityLog
- GreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema)
- HoneyForge - Deception Sensor Interaction
- HoneyLabs TI Map IP Entity to CommonSecurityLog
- HoneyLabs TI Map URL Entity to CommonSecurityLog
- IP address of Windows host encoded in web request
- Illusive Incidents Analytic Rule
- Infoblox - Data Exfiltration Attack
- Infoblox - High Threat Level Query Not Blocked Detected
- Infoblox - IQ for TD Insight Detected - CDC Source
- Infoblox - Many High Threat Level Queries From Single Host Detected
- Infoblox - Many High Threat Level Single Query Detected
- Infoblox - Many NXDOMAIN DNS Responses Detected
- Infoblox - SOC Insight Detected - CDC Source
- Infoblox - TI - CommonSecurityLog Match Found - MalwareC2
- Infoblox - TI - InfobloxCDC Match Found - Lookalike Domains
- Infoblox - TI - Syslog Match Found - URL
- Known Forest Blizzard group domains - July 2019
- Log4j vulnerability exploit aka Log4Shell IP IOC
- Lumen TI IPAddress in CommonSecurityLog
- Mercury - Domain, Hash and IP IOCs - August 2022
- Microsoft COVID-19 file hash indicator matches
- Network Port Sweep from External Network (ASIM Network Session schema)
- Network endpoint to host executable correlation
- PRODAFT USTA - TI map File Hash to CommonSecurityLog
- Palo Alto - possible nmap scan on with top 100 option
- Ping Federate - Abnormal password reset attempts
- Ping Federate - Abnormal password resets for user
- Ping Federate - Authentication from new IP.
- Ping Federate - Forbidden country
- Ping Federate - New user SSO success login
- Ping Federate - OAuth old version
- Ping Federate - Password reset request from unexpected source IP address..
- Ping Federate - SAML old version
- Ping Federate - Unexpected authentication URL.
- Ping Federate - Unexpected country for user
- Ping Federate - Unusual mail domain.
- Port scan detected (ASIM Network Session schema)
- Possible AiTM Phishing Attempt Against Microsoft Entra ID
- Possible Phishing with CSL and Network Sessions
- Possible contact with a domain generated by a DGA
- Potential DGA detected (ASIM DNS Schema)
- Potential beaconing activity (ASIM Network Session schema)
- Prestige ransomware IOCs Oct 2022
- Process Creation with Suspicious CommandLine Arguments
- RunningRAT request parameters
- Silverfort - AS-REP roasting
- Silverfort - Authentication input injection
- Silverfort - Certifried Incident
- Silverfort - Credential scanning
- Silverfort - Denied MFA with risk indicators
- Silverfort - Domain controller log cleared
- Silverfort - Impossible travel
- Silverfort - Kerberoasting
- Silverfort - Kerberos checksum mismatch
- Silverfort - Lateral movement
- Silverfort - Lateral movement target discovery
- Silverfort - Log4Shell Incident
- Silverfort - Malicious IPAddress authentication
- Silverfort - NTDS.dit extraction
- Silverfort - NoPacBreach Incident
- Silverfort - Privileged group membership addition
- Silverfort - Remote service installation
- Silverfort - Repeated denied MFA prompts
- Silverfort - SMB share enumeration
- Silverfort - UserBruteForce Incident
- SonicWall - Capture ATP Malicious File Detection
- Speculus - Network traffic to or from high-risk IP indicator
- Star Blizzard C2 Domains August 2022
- TI Map Domain entity to Dns Events (ASIM DNS Schema)
- TI Map Domain entity to PaloAlto CommonSecurityLog
- TI Map Domain entity to Web Session Events (ASIM Web Session schema)
- TI Map File Hash to CommonSecurityLog Event
- TI Map IP Entity to CommonSecurityLog
- TI Map IP Entity to CommonSecurityLog
- TI Map IP entity to DNS Events (ASIM DNS schema)
- TI Map IP entity to Network Session Events (ASIM Network Session schema)
- TI Map IP entity to Web Session Events (ASIM Web Session schema)
- TI Map URL entity to Web Session Events (ASIM Web Session schema)
- TI map Domain entity to Dns Events (ASIM DNS Schema)
- TI map Domain entity to PaloAlto CommonSecurityLog
- TI map Domain entity to Web Session Events (ASIM Web Session schema)
- TI map File Hash to CommonSecurityLog Event
- TI map IP entity to DNS Events (ASIM DNS schema)
- TI map IP entity to Network Session Events (ASIM Network Session schema)
- TI map IP entity to Web Session Events (ASIM Web Session schema)
- Threat Essentials - Time series anomaly for data size transferred to public internet
- Time series anomaly detection for total volume of traffic
- Time series anomaly for data size transferred to public internet
- User agent search for log4j exploitation attempt
- Vectra AI Detect - Detections with High Severity
- Vectra AI Detect - New Campaign Detected
- Vectra AI Detect - Suspected Compromised Account
- Vectra AI Detect - Suspected Compromised Host
- Vectra AI Detect - Suspicious Behaviors by Category
- Vectra Account's Behaviors
- Vectra Host's Behaviors
- Votiro - File Blocked from Connector
- Votiro - File Blocked in Email
- Vulerabilities
- Wazuh - Large Number of Web errors from an IP
- Windows host username encoded in base64 web request
- [Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022
- vArmour AppController - SMB Realm Traversal
Events
No event-level rows: this source is tiered as a whole.