Detection: Cisco ASA - User Account Deleted From Local Database

Updated Date: 2025-11-18 ID: 2d4b9e7f-5c3a-4d8e-9b1f-8a6c5e2d4f7a Author: Nasreddine Bencherchali, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

This analytic detects deletion of user accounts from Cisco ASA devices via CLI or ASDM. Adversaries may delete local accounts to cover their tracks, remove evidence of their activities, disrupt incident response efforts, or deny legitimate administrator access during an attack. Account deletion can also indicate an attempt to hide the creation of temporary accounts used during compromise. The detection monitors for ASA message ID 502102, which is generated whenever a local user account is deleted from the device, capturing details including the deleted username, privilege level, and the administrator who performed the deletion. Investigate unexpected account deletions, especially those involving privileged accounts (level 15), deletions performed outside business hours, deletions by non-administrative users, or deletions that coincide with other suspicious activities.

Search

 1`cisco_asa`
 2message_id IN (502102)
 3
 4| fillnull
 5
 6| stats count earliest(_time) as firstTime
 7        latest(_time) as lastTime
 8        values(action) as action
 9        values(message_id) as message_id
10        values(result) as result
11        values(privilege_level) as privilege_level
12  by host user
13
14| `security_content_ctime(firstTime)`
15
16| `security_content_ctime(lastTime)`
17
18| `cisco_asa___user_account_deleted_from_local_database_filter`

Data Source

Name	Platform	Sourcetype	Source
Cisco ASA Logs	Other	`'cisco:asa'`	`'not_applicable'`

Macros Used

Name	Value
cisco_asa	`sourcetype=cisco:asa`
cisco_asa___user_account_deleted_from_local_database_filter	`search *`

cisco_asa___user_account_deleted_from_local_database_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1531	Account Access Removal	Impact
T1070.008	Clear Mailbox Data	Defense Evasion

Actions on Objectives

Exploitation

DE.AE

CIS 13

Akira

LAPSUS$

Scattered Spider

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Risk Event	True

This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.

Implementation

This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA. To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 502102. If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message ID 502102. You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html. You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da

Known False Positives

Legitimate deletions occur during employee offboarding, contractor removal, account cleanup, or service account decommissioning. Verify against HR records and change management tickets. Filter known admin accounts during business hours.

Associated Analytic Story

Suspicious Cisco Adaptive Security Appliance Activity

Risk Based Analytics (RBA)

Risk Message:

Local user account $user$ with privilege level $privilege_level$ was deleted from Cisco ASA host $host$.

Risk Object	Risk Object Type	Risk Score	Threat Objects
host	system	40	No Threat Objects
user	user	40	No Threat Objects

References

https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/asa-syslog/syslog-messages-500000-to-520025.html#con_4773969

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`not_applicable`	`cisco:asa`
Integration	✅ Passing	Dataset	`not_applicable`	`cisco:asa`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1