Modify Authentication Process: Network Device Authentication `T1556.004`

Tactics: Defense Impairment, Persistence, Credential Access

Adversaries may use Patch System Image to hard code a password in the operating system, thus bypassing of native authentication mechanisms for local accounts on network devices.

Authoring guide

These 2 rules share fields, values, and exclusions.

Fields filtered most (3 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`command`	1	`in` 1	`aaa authentication`, `aaa authorization`, `aaa local authentication*`
`message_id`	1	`in` 1	`111008`, `111010`
`sourcetype`	1	`eq` 1	`cisco:asa`

Top indicator values (8 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`command`	`in`	`aaa authentication*` splunkCisco ASA - AAA Policy Tampering	1
`command`	`in`	`aaa authorization*` splunkCisco ASA - AAA Policy Tampering	1
`command`	`in`	`aaa local authentication*` splunkCisco ASA - AAA Policy Tampering	1
`command`	`in`	`aaa-server*` splunkCisco ASA - AAA Policy Tampering	1
`command`	`in`	`no aaa*` splunkCisco ASA - AAA Policy Tampering	1
`message_id`	`in`	`111008` splunkCisco ASA - AAA Policy Tampering	1	7
`message_id`	`in`	`111010` splunkCisco ASA - AAA Policy Tampering	1	7
`sourcetype`	`eq`	`cisco:asa` splunkCisco ASA - AAA Policy Tampering	1	13

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Network

Domain: Network

Sigma 1 rule

Cisco Dot1x Disabled

Splunk 1 rule

Cisco ASA - AAA Policy Tampering