Detection: Cisco ASA - Logging Disabled via CLI

Updated Date: 2025-10-17 ID: 7b4c9f3e-5a88-4b7b-9c4b-94d8e5d67201 Author: Bhavin Patel, Micheal Haag, Nasreddine Bencherchali, Splunk Type: TTP Product: Splunk Enterprise Security

Description

This analytic detects the disabling of logging functionality on a Cisco ASA device through CLI commands. Adversaries or malicious insiders may attempt to disable logging to evade detection and hide malicious activity. The detection looks for specific ASA syslog message IDs (111010, 111008) associated with command execution, combined with suspicious commands such as no logging, logging disable, clear logging, or no logging host. Disabling logging on a firewall or security device is a strong indicator of defense evasion.

Search

 1`cisco_asa`
 2message_id IN (111008, 111010)
 3command IN (
 4    "*no logging*",
 5    "*logging disable*",
 6    "*clear logging*",
 7    "*no logging host*",
 8    "*no logging trap*"
 9)
10
11| stats earliest(_time) as firstTime
12        latest(_time) as lastTime
13        values(user) as user
14        values(action) as action
15        values(message_id) as message_id
16        values(command) as command
17        values(src_ip) as src_ip
18        values(process_name) as process_name
19  by host
20
21| `security_content_ctime(firstTime)`
22
23| `security_content_ctime(lastTime)`
24
25| `cisco_asa___logging_disabled_via_cli_filter`

Data Source

Name	Platform	Sourcetype	Source
Cisco ASA Logs	Other	`'cisco:asa'`	`'not_applicable'`

Macros Used

Name	Value
cisco_asa	`sourcetype=cisco:asa`
cisco_asa___logging_disabled_via_cli_filter	`search *`

cisco_asa___logging_disabled_via_cli_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1562	Impair Defenses	Defense Evasion

Exploitation

DE.CM

CIS 13

Magic Hound

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Notable	Yes
Rule Title	`%name%`
Rule Description	`%description%`
Notable Event Fields	user, dest
Creates Risk Event	True

This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.

Implementation

This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA. To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 111008 and 111010. If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message IDs 111008 and 111010. You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html. You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da

Known False Positives

Administrators may intentionally disable or modify logging during maintenance, troubleshooting, or device reconfiguration. These events should be verified against approved change management activities.

Associated Analytic Story

Suspicious Cisco Adaptive Security Appliance Activity

Risk Based Analytics (RBA)

Risk Message:

User $user$ executed command $command$ to disable logging on the Cisco ASA host $host$.

Risk Object	Risk Object Type	Risk Score	Threat Objects
host	system	80	src_ip

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`not_applicable`	`cisco:asa`
Integration	✅ Passing	Dataset	`not_applicable`	`cisco:asa`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 3