Detection: Cisco Network Interface Modifications

Updated Date: 2025-08-21 ID: 61ae09c2-079e-44b1-8be0-74e35c5a679e Author: Bhavin Patel, Michael Haag, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

This analytic detects the creation or modification of network interfaces on Cisco devices, which could indicate an attacker establishing persistence or preparing for lateral movement. After gaining initial access to network devices, threat actors like Static Tundra often create new interfaces (particularly loopback interfaces) to establish covert communication channels or maintain persistence. This detection specifically looks for the configuration of new interfaces, interface state changes, and the assignment of IP addresses to interfaces. These activities are particularly concerning when they involve unusual interface names or descriptions containing suspicious terms.

Search

1
2| tstats `security_content_summariesonly` count values(All_Changes.command) as command min(_time) as firstTime max(_time) as lastTime from datamodel=Change.All_Changes where ( (All_Changes.command="*interface*") OR (All_Changes.command="*LINEPROTO-5-UPDOWN*") OR (All_Changes.command="*ip address*") ) by All_Changes.dvc All_Changes.user 
3| `drop_dm_object_name("All_Changes")` 
4| rename dvc as dest 
5| `security_content_ctime(firstTime)` 
6| `security_content_ctime(lastTime)` 
7| `cisco_network_interface_modifications_filter`

Data Source

Name	Platform	Sourcetype	Source
Cisco IOS Logs	N/A	`'cisco:ios'`	`'cisco:ios'`

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
cisco_network_interface_modifications_filter	`search *`

cisco_network_interface_modifications_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1556	Modify Authentication Process	Credential Access
T1021	Remote Services	Defense Evasion
T1133	External Remote Services	Persistence

Delivery

Exploitation

Installation

DE.AE

CIS 13

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Risk Event	True

This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.

Implementation

To implement this search, you need to be ingesting Cisco IOS logs with the sourcetype "cisco:ios" and have these logs mapped to the Change datamodel. Ensure that your Cisco IOS devices are configured to send logs to your Splunk environment, with appropriate logging levels enabled to capture interface configuration changes and line protocol state changes. Configure command logging on Cisco IOS devices using the "archive log config logging enable" command and ensure that syslog is properly configured to capture LINEPROTO-5-UPDOWN messages.

Known False Positives

Legitimate network interface configuration changes may trigger this detection during routine network maintenance or initial device setup. Network administrators often need to create or modify interfaces as part of normal operations. To reduce false positives, consider implementing a baseline of expected administrative activities, including approved administrative usernames, typical times for interface configuration changes, and scheduled maintenance windows. You may also want to create a lookup table of approved interface naming conventions and filter out alerts for standard interface configurations.

Associated Analytic Story

Cisco Smart Install Remote Code Execution CVE-2018-0171

Risk Based Analytics (RBA)

Risk Message:

Suspicious network interface modifications detected on Cisco device $dest$ by user $user$, which may indicate persistence establishment

Risk Object	Risk Object Type	Risk Score	Threat Objects
user	user	45	command
dest	system	55	command

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`cisco:ios`	`cisco:ios`
Integration	✅ Passing	Dataset	`cisco:ios`	`cisco:ios`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1