Query: detection rule: Detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface. Disabling dot1x bypasses Netw
Matching passage: Sigma rule: Detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface. Disabling dot1x bypasses Netw. Logsource: cisco / aaa. Rule: title: Cisco Dot1x Disabled id: ef0ff092-a24a-4fbc-beea-06c08d53e085 status: experimental description: 'Detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface. Disabling dot1x bypasses Network Access Control (NAC) mechanisms, potentially allowing unauthorized devices to gain access to the internal network. This activity is a common technique used by attackers or malicious insiders to establish persistence or perform lateral movement via rogue devices. ' references: - https://www.cisco.com/en/US/docs/ios-xml/ios/san/command/san-xe-3se-3850-cr-book_chapter_00.html#wp3394428680 - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-xe-3se-3850-cr-book/sec-a1-xe-3se-3850-cr-book_chapter_010.html#wp3502072400 - https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_53_se/command/reference/2960ComRef/cli1.html#47220 author: Luc Génaux date: 2026-04-28 tags: - attack.persistence - attack.credential-access - attack.defense-impairment - attack.t1685 - attack.t1556.004 logsource: product: cisco service: aaa detection: keywords: - access-session port-control force-authorized - authentication port-control force-authorized - dot1x port-control force-authorized - no access-session port-control - no authentication port-control - no dot1x port-control - no dot1x system-auth-control condition: keywords falsepositives: - Administrator troubleshooting connectivity issues level: medium
Near-miss passage: Sigma rule: Detects the execution of "reg.exe" to alter registry keys that would replace the user's desktop background. This is a co. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Desktop Background Change Using Reg.EXE id: 8cbc9475-8d05-4e27-9c32-df960716c701 related: - id: 85b88e05-dadc-430b-8a9e-53ff1cd30aae type: similar status: test description: 'Detects the execution of "reg.exe" to alter registry keys that would replace the user''s desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image. ' references: - https://www.attackiq.com/2023/09/20/emulating-rhysida/ - https://research.checkpoint.com/2023/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/ - https://www.trendmicro.com/en_us/research/23/h/an-overview-of-the-new-rhysida-ransomware.html - https://www.virustotal.com/gui/file/a864282fea5a536510ae86c77ce46f7827687783628e4f2ceb5bf2c41b8cd3c6/behavior - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsDesktop::Wallpaper - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.ControlPanelDisplay::CPL_Personalization_NoDesktopBackgroundUI author: Stephen Lincoln @slincoln-aiq (AttackIQ) date: 2023-12-21 tags: - attack.persistence - attack.impact - attack.defense-impairment - attack.t1112 - attack.t1491.001 logsource: product: windows category: process_creation detection: selection_reg_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_reg_flag: CommandLine|contains: add selection_keys: CommandLine|contains: - Control Panel\Desktop - CurrentVersion\Policies\ActiveDesktop - CurrentVersion\Policies\System selection_cli_reg_1: CommandLine|contains|all: - /v NoChangingWallpaper - /d 1 selection_cli_reg_2: CommandLine|contains|all: - /v Wallpaper - /t REG_SZ selection_cli_reg_3: CommandLine|contains|all: - /v WallpaperStyle - /d 2 condition: all of selection_reg_* and selection_keys and 1 of selection_cli_reg_* falsepositives: - Administrative scripts that change the desktop background to a company logo or other image. level: medium