Detect Network Device Authentication in Elastic Security
Adversaries may patch network device operating systems to add a hardcoded backdoor password, bypassing normal authentication for local accounts on routers, switches, and VPN appliances. SYNful Knock implanted a backdoor password in Cisco IOS router images, checking if login credentials match the backdoor password before passing them to normal authentication. SLOWPULSE modified Pulse Secure LDAP and 2FA authentication to accept a designated attacker-supplied password. Detection relies on network configuration integrity checks and unusual authentication behavior.
MITRE ATT&CK
- Technique
- T1556 Modify Authentication Process
- Sub-technique
- T1556.004 Network Device Authentication
- Canonical reference
- https://attack.mitre.org/techniques/T1556/004/
Elastic Detection Query
sequence by host.name, source.ip with maxspan=1h
[authentication where
event.outcome == "failure" and
(
event.dataset in ("cisco.ios", "cisco.asa", "juniper.junos", "palo_alto.firewall") or
host.name : ("*router*", "*switch*", "*fw*", "*vpn*", "*asa*", "*ios*", "*junos*", "*nexus*", "*palo*") or
log.syslog.facility.name in ("security", "auth", "authpriv")
)
] with runs=5
[authentication where
event.outcome == "success" and
(
event.dataset in ("cisco.ios", "cisco.asa", "juniper.junos", "palo_alto.firewall") or
host.name : ("*router*", "*switch*", "*fw*", "*vpn*", "*asa*", "*ios*", "*junos*", "*nexus*", "*palo*") or
log.syslog.facility.name in ("security", "auth", "authpriv")
)
]Detects potential hardcoded backdoor authentication on network devices (T1556.004) using an EQL sequence that requires 5+ authentication failures followed by a success from the same source IP against the same network device within a 1-hour window. This failure-then-success pattern is consistent with an attacker testing a backdoor credential after observing failed legitimate attempts, as documented with SYNful Knock (Cisco IOS) and SLOWPULSE (Pulse Secure). An alternative rule should separately flag clean-success anomalies (zero failures, many successes) using a threshold alert over this same filter for the no-prior-failures backdoor variant.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate password rotation distributed late to network operations staff causes a burst of failures from the same admin workstation IP before a successful login with the newly issued credential, matching the runs=5 failure-then-success sequence.
- Automated configuration management tools (Ansible, Cisco NSO, SolarWinds NCM) authenticating with rotating service account credentials may generate multiple failure events before the updated credential is used, producing sequences that match the detection window.
- Network engineers accessing devices after a PAM vault credential rotation will fail several times using a cached credential before retrieving the updated password from the vault and authenticating successfully, appearing identical to backdoor exploitation.
Other platforms for T1556.004
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Verify Cisco IOS Image Hash (Integrity Check)
Expected signal: SSH authentication event in network device syslog. Network device syslog entry for privileged exec command execution. If syslog forwarding is configured, Splunk/Sentinel will capture the authentication and command events.
- Test 2Simulate Failed Network Device Authentication (Syslog Testing)
Expected signal: Network device syslog entries: 'Authentication failed for user testuser from <IP>'. If forwarded to SIEM: Splunk index=network_syslog with authentication failure events. Five events in rapid succession should trigger the failure rate detection.
- Test 3Check Network Device Syslog Collection
Expected signal: Test syslog message appearing in SIEM with source IP of the test host. The message mimics a Cisco IOS login success event and should match the network device authentication detection patterns.
References (5)
- https://attack.mitre.org/techniques/T1556/004/
- https://cloud.google.com/blog/topics/threat-intelligence/synful-knock-acis/
- https://tools.cisco.com/security/center/resources/integrity_assurance.html
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1556.004/T1556.004.md
- https://www.mandiant.com/resources/blog/mandiant-identifies-new-pulse-connect-secure-vulnerabilities
Unlock Pro Content
Get the full detection package for T1556.004 including response playbook, investigation guide, and atomic red team tests.