Salt TTPs - #4114

Merged

patel-bhavin merged 8 commits into

Jun 9, 2026

nasbench commented Jun 2, 2026 •

edited

Loading

Contributor

This PR adds new analytics related to Salt Typhoon tradecraft targeting Cisco devices.

New Analytics [9]

Cisco IOS XE Guestshell Activation and Destroy
Cisco IOS XE Log Clearing Sequence With Optional Loopback Removal
Cisco IOS XE Reconnaissance Command Activity
Cisco IOS XE Remote Access Probe Burst
Cisco IOS XE Request Platform Package Describe Shell Pattern
Cisco IOS XE Tunnel Interface Configuration
Cisco IOS XE VTY Access Class Tampering
Cisco IOS XE WebUI Login From IOSd Local Port
Cisco IOS XE WebUI Programmatic Configuration

New Macros [1]

cisco_ios


          first batch

b48ee5e

github-actions Bot added Detections Macros labels

nasbench added 4 commits

June 3, 2026 00:24


          small ci fixes

c6b912b


          multiples fixes

29c2e86


          more fixes

7c2f4aa


          metadata update

23eaa0c

nasbench added this to the v6.1.0 milestone


          Merge branch 'develop' into salt

72610ea

nasbench marked this pull request as ready for review

June 8, 2026 15:18

nasbench requested review from ljstella and patel-bhavin as code owners

June 8, 2026 15:18

nasbench changed the title ~~Salt~~ Salt TTP

patel-bhavin reviewed

View reviewed changes

detections/network/cisco_ios_xe_guestshell_activation_and_destroy.yml Outdated

patel-bhavin reviewed

View reviewed changes

detections/network/cisco_ios_xe_guestshell_activation_and_destroy.yml Outdated

patel-bhavin reviewed

View reviewed changes

detections/network/cisco_ios_xe_log_clearing_sequence_with_optional_loopback_removal.yml Outdated

patel-bhavin reviewed

View reviewed changes

detections/application/cisco_ios_xe_remote_access_probe_burst.yml

patel-bhavin reviewed

View reviewed changes

detections/network/cisco_ios_xe_webui_login_from_iosd_local_port.yml Outdated

patel-bhavin reviewed

View reviewed changes

detections/application/cisco_ios_xe_request_platform_package_describe_shell_pattern.yml

patel-bhavin reviewed

View reviewed changes

detections/application/cisco_ios_xe_reconnaissance_command_activity.yml

patel-bhavin reviewed

View reviewed changes

detections/application/cisco_ios_xe_webui_programmatic_configuration.yml


          apply review suggestions

82cf974

patel-bhavin approved these changes

View reviewed changes


          Merge branch 'develop' into salt

7d29bd2

patel-bhavin commented Jun 9, 2026

Contributor

Looks good!

patel-bhavin merged commit 725b0c3 into develop

6 checks passed

patel-bhavin deleted the salt branch

June 9, 2026 12:41

nasbench changed the title ~~Salt TTP~~ Salt TTPs

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Detections Macros