Cisco Device Shutdown or Boot Mode Change

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•35

This rule detects attempts to shut down a Cisco device or change its boot mode by looking for specific keywords in Cisco AAA logs. The keywords 'shutdown', 'config-register 0x2100', and 'config-register 0x2142' indicate actions that can lead to a denial of service or a change in the device's operational state.