Techniques › T1059.008 › AN0399
AN0399 Analytic 0399
Network Devices · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects unauthorized or anomalous use of command-line interfaces (CLI) on network devices. Focuses on remote access sessions (e.g., SSH/Telnet), privilege escalation within CLI sessions, execution of high-risk commands (e.g., config replace, terminal monitor, no logging), and configuration changes outside of approved windows.</p>
- Detects
- T1059.008 Network Device CLI
- Part of
- DET0142 Behavioral Detection of CLI Abuse on Network Devices
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| networkdevice:syslog | command_exec | DC0064 Command Execution |
| NSM:Flow | remote CLI session detection | DC0085 Network Traffic Content |
| networkdevice:syslog | authorization/accounting logs | DC0002 User Account Authentication |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Config changes made outside of maintenance windows are more suspicious. |
UserContext | Unexpected CLI activity by service accounts or users not assigned to manage network devices. |
CommandPattern | Regex or keyword match on dangerous or unusual commands (e.g., 'no logging', 'reload', 'copy tftp', 'config replace'). |
SourceIP | Remote CLI sessions originating from untrusted networks or jump hosts. |
SessionDuration | Abnormally short or long SSH/Telnet CLI sessions compared to baseline. |