Network Device CLI abuse (MITRE ATT&CK T1059.008) is an Execution technique that applies to network devices only.
The CLI is the main way administrators view system information, change device operation and run diagnostics. It usually has permission levels that gate which commands a user can run. Many devices also offer a scripting interpreter that extends the built-in command set. You reach both through a direct console connection, or remotely with telnet or SSH.
How attackers use it
MITRE says adversaries can use the network CLI to change how a device behaves. Three examples are named: manipulating traffic flows to intercept or alter data, modifying startup configuration to load malicious system software, and disabling security features or logging to avoid detection.
A device that sits in the path of your traffic is a strong vantage point, and it often has far less endpoint monitoring than a server.
How to detect it
MITRE's detection strategy looks for unauthorized or unusual use of the CLI. The signals it names:
- Remote access sessions over SSH or telnet from unexpected sources.
- Privilege escalation inside a CLI session.
- High-risk commands such as config replace, terminal monitor and no logging.
- Configuration changes outside approved change windows.
To make that possible, send device syslog and AAA accounting records to a central system, and compare configuration changes to your change calendar.
How to reduce the risk
MITRE lists three mitigations, all built on Authentication, Authorization and Accounting (AAA):
- Execution prevention. TACACS+ can control which commands administrators may use through authentication and command authorization.
- Privileged account management. AAA limits what administrators can do and gives a history of their actions, which helps detect abuse.
- User account management. Apply least privilege so only authorized users can make configuration changes.
Check your own environment
# Cisco IOS style device: who is logged in now, and recent logs
show users
show logging
Then confirm that command accounting is on, that logs leave the device in near real time, and that telnet is off where SSH is available.
Quick check
What does TACACS+ add beyond a login?
Command authorization. It can control which commands administrators are permitted to run, and AAA records a history of what they did.
