splunk_escuTTP

Cisco ASA - Logging Disabled via CLI

This analytic detects the disabling of logging functionality on a Cisco ASA device through CLI commands. Adversaries or malicious insiders may attempt to disable logging to evade detection and hide malicious activity. The detection looks for specific ASA syslog message IDs (111010, 111008) associated with command execution, combined with suspicious commands such as `no logging`, `logging disable`, `clear logging`, or `no logging host`. Disabling logging on a firewall or security device is a strong indicator of defense evasion.

MITRE ATT&CK

T1562

Detection Query

`cisco_asa`
message_id IN (111008, 111010)
command IN (
    "*no logging*",
    "*logging disable*",
    "*clear logging*",
    "*no logging host*",
    "*no logging trap*"
)
| stats earliest(_time) as firstTime
        latest(_time) as lastTime
        values(user) as user
        values(action) as action
        values(message_id) as message_id
        values(command) as command
        values(src_ip) as src_ip
        values(process_name) as process_name
  by host
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `cisco_asa___logging_disabled_via_cli_filter`

Author

Bhavin Patel, Micheal Haag, Nasreddine Bencherchali, Splunk

Created

2026-03-10

Data Sources

Cisco ASA Logs

References

Tags

Suspicious Cisco Adaptive Security Appliance Activity

Raw Content

name: Cisco ASA - Logging Disabled via CLI
id: 7b4c9f3e-5a88-4b7b-9c4b-94d8e5d67201
version: 5
date: '2026-03-10'
author: Bhavin Patel, Micheal Haag, Nasreddine Bencherchali, Splunk
status: production
type: TTP
description: |
    This analytic detects the disabling of logging functionality on a Cisco ASA device
    through CLI commands. Adversaries or malicious insiders may attempt to disable logging
    to evade detection and hide malicious activity. The detection looks for specific ASA
    syslog message IDs (111010, 111008) associated with command execution,
    combined with suspicious commands such as `no logging`, `logging disable`,
    `clear logging`, or `no logging host`. Disabling logging on a firewall or security device
    is a strong indicator of defense evasion.
data_source:
    - Cisco ASA Logs
search: |
    `cisco_asa`
    message_id IN (111008, 111010)
    command IN (
        "*no logging*",
        "*logging disable*",
        "*clear logging*",
        "*no logging host*",
        "*no logging trap*"
    )
    | stats earliest(_time) as firstTime
            latest(_time) as lastTime
            values(user) as user
            values(action) as action
            values(message_id) as message_id
            values(command) as command
            values(src_ip) as src_ip
            values(process_name) as process_name
      by host
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_asa___logging_disabled_via_cli_filter`
how_to_implement: |
    This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
    To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 111008 and 111010.
    If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message IDs 111008 and 111010.
    You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
    You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
known_false_positives: |
    Administrators may intentionally disable or modify logging during maintenance, troubleshooting, or device reconfiguration.
    These events should be verified against approved change management activities.
references:
    - https://www.cisco.com/site/us/en/products/security/firewalls/adaptive-security-appliance-asa-software/index.html
    - https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
drilldown_searches:
    - name: View the detection results for $host$
      search: '%original_detection_search% | search  host = $host$'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for $host$
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
rba:
    message: User $user$ executed command $command$ to disable logging on the Cisco ASA host $host$.
    risk_objects:
        - field: host
          type: system
          score: 50
    threat_objects:
        - field: src_ip
          type: ip_address
tags:
    analytic_story:
        - Suspicious Cisco Adaptive Security Appliance Activity
    asset_type: Network
    mitre_attack_id:
        - T1562
    product:
        - Splunk Enterprise
        - Splunk Enterprise Security
        - Splunk Cloud
    security_domain: network
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_asa/generic/cisco_asa_generic_logs.log
          source: not_applicable
          sourcetype: cisco:asa