Cisco Local Account Creation or Modification and AAA Configuration Changes

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•34

This rule detects the creation or modification of local user accounts and changes to remote authentication configurations on Cisco devices. It specifically looks for keywords 'username' and 'aaa' in Cisco AAA logs, indicating actions related to account management or authentication settings.