Cisco Privileged Account Creation with Suspicious SSH Activity

splApache-2.0from splunk/security_content

This analytic detects a correlation between privileged account creation on Cisco IOS devices and subsequent inbound SSH connections to non-standard ports or sshd_operns by correlating risk events This correlation identifies when both "Cisco IOS Suspicious Privileged Account Creation" and SSH-related Snort detections ("SSH Connection to sshd_operns" or "SSH Connection to Non-Standard Port") fire for the same network device. This behavior is highly indicative of persistence establishment following initial compromise.