Threat video1:00
Cisco Smart Software Manager Dirty Cert: Detection & IOCs
An authenticated admin's certificate upload runs commands as root in Cisco Smart Software Manager: 9 detection rules, 9 IOCs and a free Splunk SPL rule.
Read the full threat intel for Cisco Smart Software Manager Dirty Cert: Detection & IOCs →
Chapters
- 0:00The hookCisco silently patched a command injection bug.
- 0:04The storyOnly an admin could trigger the bug.
- 0:11Attack pathAn authenticated admin starts the chain.
- 0:27AttributionNo threat actor is attributed.
- 0:32Indicators of compromise4 indicators to hunt: 3 URLs and 1 file name.
- 0:38MITRE ATT&CK techniques5 ATT&CK techniques, from initial access to collection.
- 0:43Remediation4 steps now: Upgrade Cisco Smart Software Manager / Cisco License On-Prem.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Cisco silently patched a command injection bug.
0:05Only an admin could trigger the bug.
0:07A certificate upload ran commands.
0:11An authenticated admin starts the chain.
0:14The certificate upload reaches the nginx configurator.
0:18User input reaches execSync, which runs commands.
0:21STAR Labs says the fix removed the sink.
0:27No threat actor is attributed. Confidence: low.
0:324 indicators to hunt: 3 URLs and 1 file name.
0:385 ATT&CK techniques, from initial access to collection.
0:434 steps now: Upgrade Cisco Smart Software Manager / Cisco License On-Prem.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.