Detection: Cisco Privileged Account Creation with HTTP Command Execution

Updated Date: 2026-01-06 ID: 2c9d4f5a-8b6e-4c7f-9d8e-1a2b3c4d5e6f Author: Nasreddine Bencherchali, Splunk Type: Correlation Product: Splunk Enterprise Security

Description

This analytic correlates risk events between privileged account creation on Cisco IOS devices and HTTP requests to privileged execution paths such as /level/15/exec/-/*. APT actors have been observed creating privileged accounts and then running commands on routers via HTTP GET or POST requests that target privileged execution paths. These requests allow attackers to execute commands with the highest privilege level (15) on Cisco devices without requiring interactive SSH access. This correlation identifies when both "Cisco IOS Suspicious Privileged Account Creation" and "Privileged Command Execution via HTTP" Snort detections fire for the same network device. This behavior indicates an attacker leveraging the newly created account to execute commands remotely via HTTP.

Search

 1
 2| tstats `security_content_summariesonly`
 3  min(_time) as firstTime
 4  max(_time) as lastTime
 5  sum(All_Risk.calculated_risk_score) as risk_score
 6  count(All_Risk.calculated_risk_score) as risk_event_count
 7
 8  values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id
 9  dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count
10
11  values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id
12  dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count
13
14  values(All_Risk.tag) as tag
15  values(source) as source
16  dc(source) as source_count
17
18  values(contributing_events_search)
19
20  values(All_Risk.threat_object)
21
22  from datamodel=Risk.All_Risk where
23
24  source IN (
25    "*Cisco IOS Suspicious Privileged Account Creation*",
26    "*Cisco Secure Firewall - Privileged Command Execution via HTTP*"
27  )
28  by All_Risk.normalized_risk_object
29
30| `drop_dm_object_name(All_Risk)`
31
32| `security_content_ctime(firstTime)`
33
34| `security_content_ctime(lastTime)`
35
36| where source_count >= 2
37
38| `cisco_privileged_account_creation_with_http_command_execution_filter`

Data Source

No data sources specified for this detection.

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
cisco_privileged_account_creation_with_http_command_execution_filter	`search *`

cisco_privileged_account_creation_with_http_command_execution_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1021.004	SSH	Lateral Movement
T1136	Create Account	Persistence
T1078	Valid Accounts	Defense Evasion

Delivery

Exploitation

Installation

DE.AE

CIS 13

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Notable	Yes
Rule Title	`%name%`
Rule Description	`%description%`
Notable Event Fields	user, dest
Creates Risk Event	False

This configuration file applies to all detections of type Correlation. These correlations will generate Notable Events.

Implementation

This correlation search requires that the following detections are enabled and generating risk events - "Cisco IOS Suspicious Privileged Account Creation" and "Cisco Secure Firewall - Privileged Command Execution via HTTP". These detections must be configured to generate risk on the same risk object field (the network device IP). The search correlates risk events within a 24-hour time window. Ensure that both Cisco IOS logs (sourcetype "cisco:ios") and Cisco Secure Firewall Threat Defense Intrusion Event logs are being ingested and that the underlying detections are properly configured.

Known False Positives

No false positives have been identified yet.

Associated Analytic Story

References

https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`not_applicable`	`stash`
Integration	✅ Passing	Dataset	`not_applicable`	`stash`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1