Cisco Show Commands for Credential Access
This rule detects the execution of 'show history', 'show history all', or 'show logging' commands on Cisco devices. These commands can expose sensitive information, including credentials, that have been entered into the device's command-line interface. Adversaries may use these commands to gather credentials or other sensitive configuration details from network devices.
Sigma
