Detection: Cisco Privileged Account Creation with Suspicious SSH Activity

Updated Date: 2026-01-06 ID: 7f8e2b4c-9a3d-4e1f-8c5b-6d7e8f9a0b1c Author: Nasreddine Bencherchali, Splunk Type: Correlation Product: Splunk Enterprise Security

Description

This analytic detects a correlation between privileged account creation on Cisco IOS devices and subsequent inbound SSH connections to non-standard ports or sshd_operns by correlating risk events This correlation identifies when both "Cisco IOS Suspicious Privileged Account Creation" and SSH-related Snort detections ("SSH Connection to sshd_operns" or "SSH Connection to Non-Standard Port") fire for the same network device. This behavior is highly indicative of persistence establishment following initial compromise.

Search

 1
 2| tstats `security_content_summariesonly`
 3  min(_time) as firstTime
 4  max(_time) as lastTime
 5
 6  sum(All_Risk.calculated_risk_score) as risk_score
 7  count(All_Risk.calculated_risk_score) as risk_event_count
 8
 9  values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id
10  dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count
11
12  values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id
13  dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count
14
15  values(All_Risk.tag) as tag
16  values(source) as source
17  dc(source) as source_count
18  
19  values(contributing_events_search)
20
21  values(All_Risk.threat_object)
22
23  from datamodel=Risk.All_Risk where
24
25  source IN (
26    "*Cisco IOS Suspicious Privileged Account Creation*",
27    "*Cisco Secure Firewall - SSH Connection to sshd_operns*",
28    "*Cisco Secure Firewall - SSH Connection to Non-Standard Port*"
29  )
30  by All_Risk.normalized_risk_object
31
32| `drop_dm_object_name(All_Risk)`
33
34| eval has_account_creation=if(
35                                match(source, "Cisco IOS Suspicious Privileged Account Creation"),
36                                1, 0
37                              )
38
39| eval has_ssh_detection=if(
40                              match(source, "SSH Connection to sshd_operns")
41                              OR
42                              match(source, "SSH Connection to Non-Standard Port"),
43                              1, 0
44                            )
45
46| where has_account_creation=1
47        AND
48        has_ssh_detection=1
49
50| `security_content_ctime(firstTime)`
51
52| `security_content_ctime(lastTime)`
53
54| `cisco_privileged_account_creation_with_suspicious_ssh_activity_filter`

Data Source

No data sources specified for this detection.

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
cisco_privileged_account_creation_with_suspicious_ssh_activity_filter	`search *`

cisco_privileged_account_creation_with_suspicious_ssh_activity_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1021.004	SSH	Lateral Movement
T1136	Create Account	Persistence
T1078	Valid Accounts	Defense Evasion

Delivery

Exploitation

Installation

DE.AE

CIS 13

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Notable	Yes
Rule Title	`%name%`
Rule Description	`%description%`
Notable Event Fields	user, dest
Creates Risk Event	False

This configuration file applies to all detections of type Correlation. These correlations will generate Notable Events.

Implementation

This correlation search requires that the following detections are enabled and generating risk events - "Cisco IOS Suspicious Privileged Account Creation", "Cisco Secure Firewall - SSH Connection to sshd_operns", and "Cisco Secure Firewall - SSH Connection to Non-Standard Port". These detections must be configured to generate risk on the same risk object field (the network device IP). The search correlates risk events within a 24-hour time window. Ensure that both Cisco IOS logs (sourcetype "cisco:ios") and Cisco Secure Firewall Threat Defense Intrusion Event logs are being ingested and that the underlying detections are properly configured.

Known False Positives

No false positives have been identified yet.

Associated Analytic Story

References

https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`not_applicable`	`stash`
Integration	✅ Passing	Dataset	`not_applicable`	`stash`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1