FSB Center 16's Router Playbook, and How to Shut It Down

let HuntStart = ago(30d);
let ScanThreshold = 15;
let TimeWindow = 5m;
CommonSecurityLog
| where TimeGenerated >= HuntStart
| where ApplicationProtocol == "SNMP"
    or DestinationPort == 161
| where isnotempty(SourceIP)
| where SourceIP !startswith "10."
    and SourceIP !startswith "192.168."
    and SourceIP !startswith "172."
| summarize
    ScanCount       = count(),
    DistinctTargets = dcount(DestinationIP),
    FirstSeen       = min(TimeGenerated),
    LastSeen        = max(TimeGenerated),
    Ports           = make_set(DestinationPort)
    by SourceIP, bin(TimeGenerated, TimeWindow)
| where DistinctTargets > ScanThreshold
| extend DurationMins = datetime_diff(
    'minute', LastSeen, FirstSeen)
| project FirstSeen, LastSeen, SourceIP,
    ScanCount, DistinctTargets,
    DurationMins, Ports
| order by DistinctTargets desc

! On each Cisco device - review
! SNMP auth failure log entries
show logging | include SNMP
show logging | include authFail
show logging | include community

! Check SNMP trap history
show snmp

! Review who queried SNMP recently
show snmp host
show snmp user

# Run from external/DMZ host
# to confirm SNMP is not exposed
nmap -sU -p 161 --open \
  -T4 <your-public-ip-range> \
  --reason

# Check for default community strings
nmap -sU -p 161 \
  --script snmp-brute \
  --script-args \
  snmp-brute.communitiesdb=\
/usr/share/seclists/Misc/\
wordlist-common-snmp-community-strings.txt \
  <your-public-ip-range>

let HuntStart = ago(30d);
CommonSecurityLog
| where TimeGenerated >= HuntStart
| where DestinationPort in (4786, 443, 80, 8443)
| where SourceIP !startswith "10."
    and SourceIP !startswith "192.168."
    and SourceIP !startswith "172."
| summarize
    ProbeCount    = count(),
    UniquePorts   = dcount(DestinationPort),
    UniqueTargets = dcount(DestinationIP),
    FirstSeen     = min(TimeGenerated),
    LastSeen      = max(TimeGenerated),
    PortList      = make_set(DestinationPort)
    by SourceIP
| extend
    SpanDays = datetime_diff(
      'day', LastSeen, FirstSeen)
| where ProbeCount > 3
| project FirstSeen, LastSeen, SourceIP,
    ProbeCount, UniqueTargets,
    SpanDays, PortList
| order by ProbeCount desc

! Check if Smart Install is enabled
show vstack config
! If output shows "Role: Client" or
! "Role: Director" - SMI is active
! Remediate: no vstack

! Also check for open TCP/4786 listener
show control-plane host open-ports \
  | include 4786

! Confirm patch level against CVE-2018-0171
show version | include Version
! Cross-reference output against:
! https://tools.cisco.com/security/center/
!   content/CiscoSecurityAdvisory/
!   cisco-sa-20180328-smi2

# https://github.com/Sab0tag3d/SIET
# Smart Install Exploitation Tool
# (use for audit/detection only)

git clone \
  https://github.com/Sab0tag3d/SIET
cd SIET
pip3 install -r requirements.txt

# Scan your subnet for SMI exposure
python3 siet.py -i <your-subnet/24> \
  --scan

# Output lists all hosts with TCP/4786
# open and responding to SMI protocol

let HuntStart = ago(30d);
let VPS_Indicators = dynamic([
    "digitalocean","linode","vultr",
    "hetzner","ovh","choopa","serverius"]);
CommonSecurityLog
| where TimeGenerated >= HuntStart
| where DestinationPort in (21, 69, 20)
| where SourceIP !startswith "10."
    and SourceIP !startswith "192.168."
    and SourceIP !startswith "172."
| extend DestHost = tostring(
    parse_url(RequestURL).Host)
| summarize
    ConnCount  = count(),
    FirstSeen  = min(TimeGenerated),
    LastSeen   = max(TimeGenerated),
    Files      = make_set(RequestURL)
    by SourceIP, DestinationIP,
       DestinationPort
| join kind=leftouter (
    ThreatIntelligenceIndicator
    | where Active == true
    | where NetworkIP != ""
    | project MaliciousIP=NetworkIP,
        ThreatType, ConfidenceScore
  ) on $left.DestinationIP ==
       $right.MaliciousIP
| project FirstSeen, LastSeen,
    SourceIP, DestinationIP,
    DestinationPort, ConnCount,
    Files, ThreatType, ConfidenceScore
| order by ConnCount desc

! Review egress ACLs on all interfaces
show ip access-lists
! Look for permit statements on:
! - UDP port 69 (TFTP)
! - TCP port 21/20 (FTP)
! Any permit = misconfiguration

! Check NetFlow for historical
! outbound TFTP/FTP connections
show ip cache flow \
  | include :0045
show ip cache flow \
  | include :0015

! Review IP accounting for
! unexpected outbound connections
show ip accounting

let HuntStart = ago(30d);
let Window = 2m;
let SNMPIn = CommonSecurityLog
| where TimeGenerated >= HuntStart
| where DestinationPort == 161
    and ApplicationProtocol == "SNMP"
| project TimeIn=TimeGenerated,
    RelayCandidate=DestinationIP,
    InboundSource=SourceIP;
let SNMPOut = CommonSecurityLog
| where TimeGenerated >= HuntStart
| where SourcePort == 161
    and ApplicationProtocol == "SNMP"
| project TimeOut=TimeGenerated,
    RelayCandidate=SourceIP,
    OutboundTarget=DestinationIP;
SNMPIn
| join kind=inner SNMPOut
    on RelayCandidate
| where abs(datetime_diff(
    'second', TimeOut, TimeIn)) <
    totalseconds(Window)
| project TimeIn, TimeOut,
    RelayCandidate, InboundSource,
    OutboundTarget
| order by TimeIn desc

! Verify IOS image integrity
verify /sha512 flash:<ios-image.bin>
! Compare hash against Cisco's
! published hash at:
! https://software.cisco.com/download/

! Check config change history
show archive log config all
! Look for changes outside
! authorized change windows

! Check if running-config differs
! from startup-config (unexpected
! in-memory changes = red flag)
show archive config differences \
  nvram:startup-config \
  system:running-config

! Review recent config modifications
show logging | include \
  "configured from\|CONFIG_I"

# Cisco IOS Software Checker
# https://tools.cisco.com/security/
#   center/softwarechecker.x

# Bulk hash verification script
# https://github.com/CiscoDevNet/
#   cisco-ios-xe-integrity-checker

git clone https://github.com/\
  CiscoDevNet/\
  cisco-ios-xe-integrity-checker
cd cisco-ios-xe-integrity-checker
pip3 install -r requirements.txt
python3 integrity_check.py \
  --host <router-ip> \
  --username <admin> \
  --password <pass>

let HuntStart = ago(30d);
let CVETerms = dynamic([
    "CVE-2018-0171","CVE-2008-4128",
    "smartinstall","smart_install",
    "cisco-smi","siet.py",
    "cisco_exploit"]);
CommonSecurityLog
| where TimeGenerated >= HuntStart
| where RequestURL has_any (CVETerms)
    or AdditionalExtensions
       has_any (CVETerms)
| where DeviceVendor in (
    "Zscaler","BlueCoat","Squid",
    "FortiGate","PaloAlto")
| project TimeGenerated, SourceIP,
    DestinationIP, RequestURL,
    DeviceAction, DeviceVendor
| order by TimeGenerated desc

! Per device - capture IOS version
show version | include \
  "IOS\|Version\|uptime\|image"

! Show platform and features
show version | include \
  "Cisco IOS\|bytes of memory"

! Bulk hunt via Ansible (if deployed)
# ansible all -m ios_command \
#   -a "commands='show version'" \
#   | grep -E "Version|IOS"

! Cross-reference against Cisco
! Software Checker for CVE-2018-0171:
! https://tools.cisco.com/security/
!   center/softwarechecker.x

# https://github.com/CiscoDevNet/
#   netdevops-examples

# Alternatively - Nessus/OpenVAS
# plugin IDs for CVE-2018-0171:
# Nessus: 109399
# OpenVAS: 1.3.6.1.4.1.25623.1.0.108330

# Run authenticated scan against
# all network device management IPs
# with these plugin IDs to find
# unpatched devices at scale

let HuntStart = ago(30d);
let AuthorisedMgmt = dynamic([
    "10.0.0.0/8",
    "172.16.0.0/12",
    "192.168.0.0/16"]);
let ExploitPorts = dynamic([4786,161]);
CommonSecurityLog
| where TimeGenerated >= HuntStart
| where DestinationPort in (ExploitPorts)
| where DeviceAction !in (
    "deny","block","drop","reset")
| where SourceIP !startswith "10."
    and SourceIP !startswith "192.168."
    and SourceIP !startswith "172."
| summarize
    SessionCount = count(),
    FirstSeen    = min(TimeGenerated),
    LastSeen     = max(TimeGenerated),
    Actions      = make_set(DeviceAction)
    by SourceIP, DestinationIP,
       DestinationPort
| project FirstSeen, LastSeen,
    SourceIP, DestinationIP,
    DestinationPort, SessionCount,
    Actions
| order by SessionCount desc

! Hunt for unexpected config changes
show logging | include \
  "CONFIG\|config\|vstack\|install"

! Hunt for new local user accounts
! (post-exploitation persistence)
show running-config | include \
  "username\|privilege\|secret"

! Check TCP connection table for
! any established sessions on 4786
show tcp brief | include 4786

! Check for unexpected AAA changes
show logging | include \
  "AAA\|privilege\|enable"

! Hunt for unexpected SNMP writes
show logging | include \
  "SNMP\|snmp\|set\|OID"

# Hunt for Cisco SMI traffic on wire
tshark -r capture.pcap \
  -Y "tcp.port == 4786" \
  -T fields \
  -e frame.time \
  -e ip.src \
  -e ip.dst \
  -e tcp.flags \
  -e data.data \
  | grep -v "^$"

# Look for SMI magic bytes in payload
tshark -r capture.pcap \
  -Y "tcp.port == 4786 and \
      data contains 00:00:00:04"

let HuntStart = ago(30d);
let ConfigCopyOID = dynamic([
    "1.3.6.1.4.1.9.9.96",
    "ccCopy","set-request",
    "CiscoCopyConfig"]);
union CommonSecurityLog, Syslog
| where TimeGenerated >= HuntStart
| where AdditionalExtensions
    has_any (ConfigCopyOID)
    or SyslogMessage
    has_any (ConfigCopyOID)
    or ProcessName contains "snmp"
| summarize
    EventCount = count(),
    FirstSeen  = min(TimeGenerated),
    LastSeen   = max(TimeGenerated),
    Hosts      = make_set(Computer),
    Sources    = make_set(SourceIP)
    by bin(TimeGenerated, 1h)
| order by FirstSeen desc

# Test read access to Config Copy MIB
# (run from authorised management host)
snmpwalk -v2c -c <community> \
  <router-ip> \
  1.3.6.1.4.1.9.9.96

# If OID tree is returned - the
# Config Copy MIB is exposed

# Test whether Set-Requests succeed
# (USE IN LAB ONLY - will trigger
#  a config copy if write access exists)
snmpset -v2c -c <community> \
  <router-ip> \
  1.3.6.1.4.1.9.9.96.1.1.1.1.14.1 \
  i 1
# i 1 = active row - if this returns
# a value, write access is open

# SNMPv3 equivalent audit
snmpwalk -v3 -l authPriv \
  -u <user> -a SHA -A <authpass> \
  -x AES -X <privpass> \
  <router-ip> \
  1.3.6.1.4.1.9.9.96

let HuntStart = ago(30d);
let BaselineStart = ago(90d);
let BaselineEnd = ago(31d);
// Build baseline of known priv-15 sources
let Baseline = Syslog
| where TimeGenerated between(
    BaselineStart .. BaselineEnd)
| where SyslogMessage contains "privilege"
    or SyslogMessage contains "level 15"
    or SyslogMessage contains "ENABLE"
| summarize BaselineSources=
    make_set(HostIP) by Computer;
// Hunt current period for new sources
Syslog
| where TimeGenerated >= HuntStart
| where SyslogMessage contains "privilege"
    or SyslogMessage contains "level 15"
    or SyslogMessage contains "ENABLE"
    or SyslogMessage contains "conf t"
| summarize
    EventCount = count(),
    FirstSeen  = min(TimeGenerated),
    Sources    = make_set(HostIP)
    by Computer
| join kind=leftouter Baseline
    on Computer
| extend NewSources = set_difference(
    Sources, BaselineSources)
| where array_length(NewSources) > 0
| project Computer, FirstSeen,
    EventCount, NewSources
| order by FirstSeen desc

! Hunt for all local user accounts
! and their privilege levels
show running-config | include \
  "^username"

! Hunt for enable password type
! Type 5 (MD5) = acceptable minimum
! Type 0 = plaintext (critical finding)
! Type 7 = reversible (critical finding)
show running-config | include \
  "enable\|secret\|password"

! Check for unexpected AAA changes
show aaa sessions
show aaa user all

! Review line access permissions
show line | include "privilege\|User"

! Check for any new users added
! since last known-good config
show archive config differences \
  nvram:startup-config \
  system:running-config \
  | include "^+.*username"

let HuntStart = ago(30d);
let KnownMgmtHosts = dynamic([
    "10.10.10.10",  // replace with
    "10.10.10.11"   // your NMS IPs
]);
CommonSecurityLog
| where TimeGenerated >= HuntStart
| where ApplicationProtocol == "SNMP"
    or DestinationPort == 161
| where SourceIP startswith "127."
    or SourceIP startswith "0.0.0."
    or SourceIP == DestinationIP
    or (
      DestinationPort == 161
      and SourceIP !in (KnownMgmtHosts)
      and SourceIP !startswith "10."
      and SourceIP !startswith "172."
      and SourceIP !startswith "192.168."
    )
| summarize
    EventCount = count(),
    FirstSeen  = min(TimeGenerated),
    LastSeen   = max(TimeGenerated),
    Targets    = make_set(DestinationIP)
    by SourceIP, DeviceAction
| project FirstSeen, LastSeen,
    SourceIP, EventCount, Targets,
    DeviceAction
| order by EventCount desc

# Capture SNMP on management interface
# and look for anomalous source IPs
tshark -i <mgmt-interface> \
  -f "udp port 161" \
  -T fields \
  -e frame.time \
  -e ip.src \
  -e ip.dst \
  -e snmp.community \
  -e snmp.type \
  -e snmp.name \
  -E header=y \
  -w snmp_hunt.pcap

# Post-capture - hunt for spoofed IPs
tshark -r snmp_hunt.pcap \
  -Y "udp.port == 161 and \
    (ip.src == 127.0.0.1 or \
     ip.src == ip.dst)" \
  -T fields \
  -e ip.src -e ip.dst \
  -e snmp.community

let HuntStart = ago(30d);
// Step 1: IPs that touched mgmt ports
let MgmtTouchers = CommonSecurityLog
| where TimeGenerated >= HuntStart
| where DestinationPort in (
    161, 4786, 22, 23)
| where DeviceAction !in (
    "deny","drop","block")
| summarize by SourceIP;
// Step 2: Hunt auth failures from
// those same IPs on other services
SigninLogs
| where TimeGenerated >= HuntStart
| where ResultType != 0
| where IPAddress in (MgmtTouchers)
| summarize
    FailCount     = count(),
    UniqueAccounts= dcount(
        UserPrincipalName),
    FirstSeen     = min(TimeGenerated),
    LastSeen      = max(TimeGenerated),
    Accounts      = make_set(
        UserPrincipalName)
    by IPAddress
| where FailCount > 5
| project FirstSeen, LastSeen,
    IPAddress, FailCount,
    UniqueAccounts, Accounts
| order by FailCount desc

! Hunt for Type 0 (plaintext) passwords
show running-config | include \
  "password 0\| password [^57]"

! Hunt for Type 7 (reversible) passwords
show running-config | include \
  "password 7"

! Hunt for enable password (not secret)
! 'enable password' = plaintext or Type 7
! 'enable secret 5' = MD5 (acceptable)
! 'enable secret 8' = PBKDF2 (good)
show running-config | include \
  "enable"

! Decode a Type 7 password in-place
! to confirm it is crackable
! (use this tool:)
! https://github.com/theevilbit/
!   ciscot7
python3 ciscot7.py -d \
  <type7-hash-from-config>

# https://github.com/theevilbit/ciscot7
git clone \
  https://github.com/theevilbit/ciscot7
cd ciscot7

# Decode all Type 7 hashes found
# in an exported config file
grep "password 7" config.bkp \
  | awk '{print $NF}' \
  | while read hash; do
      python3 ciscot7.py -d "$hash"
    done

let HuntStart = ago(30d);
let BackupWindows = dynamic([
    "02:00","03:00","04:00"]); // adjust
let EnterpriseOIDs = dynamic([
    "1.3.6.1.4.1.9.9.96",
    "1.3.6.1.4.1.9",
    "1.3.6.1.4.1"]);
CommonSecurityLog
| where TimeGenerated >= HuntStart
| where ApplicationProtocol == "SNMP"
| where AdditionalExtensions
    has_any (EnterpriseOIDs)
    or AdditionalExtensions
    contains "getBulk"
    or AdditionalExtensions
    contains "getNext"
| extend HourOfDay = format_datetime(
    TimeGenerated, "HH:mm")
| where HourOfDay !in (BackupWindows)
| summarize
    QueryCount  = count(),
    FirstSeen   = min(TimeGenerated),
    LastSeen    = max(TimeGenerated),
    OIDs        = make_set(
        AdditionalExtensions)
    by SourceIP, DestinationIP
| where QueryCount > 20
| project FirstSeen, LastSeen,
    SourceIP, DestinationIP,
    QueryCount, OIDs
| order by QueryCount desc

# From authorised NMS host
# (should succeed if NMS uses SNMP)
snmpwalk -v2c -c <ro-community> \
  <router-ip> \
  1.3.6.1.4.1.9.9.96

# From a non-management workstation
# (should FAIL - if it succeeds,
#  SNMP ACL is not enforced)
snmpwalk -v2c -c public \
  <router-ip> \
  1.3.6.1.4.1.9.9.96

# Also test default community strings
for c in public private community \
          cisco admin monitor; do
  echo "Testing: $c"
  snmpget -v2c -c $c \
    <router-ip> sysDescr.0 \
    2>/dev/null && \
    echo "*** SUCCESS: $c works ***"
done

let HuntStart = ago(30d);
let AuthorisedNMS = dynamic([
    "10.10.10.10",  // replace with
    "10.10.10.11"   // your NMS IPs
]);
let ConfigIndicators = dynamic([
    "config.bkp","output.txt",
    "copy running-config",
    "Destination filename",
    "startup-config","tftp:"]);
Syslog
| where TimeGenerated >= HuntStart
| where SyslogMessage
    has_any (ConfigIndicators)
| extend SourceAddr = extract(
    @"(\d+\.\d+\.\d+\.\d+)",
    1, SyslogMessage)
| where isnotempty(SourceAddr)
| where SourceAddr !in (AuthorisedNMS)
| summarize
    EventCount = count(),
    FirstSeen  = min(TimeGenerated),
    Messages   = make_set(
        SyslogMessage, 5)
    by Computer, SourceAddr
| project FirstSeen, Computer,
    SourceAddr, EventCount, Messages
| order by FirstSeen desc

! Hunt flash storage for staging files
dir flash: | include \
  "config.bkp\|output.txt\|.cfg\|.bkp"

dir nvram: | include \
  "config.bkp\|output.txt"

dir all-filesystems | include \
  "config.bkp\|output.txt"

! If found - preserve as evidence
! then delete:
! more flash:config.bkp
! (review contents for exfil data)
! delete /force flash:config.bkp

! Hunt archive for config history
show archive
! Review each archive entry for
! unexpected copies

let HuntStart = ago(30d);
let Window = 3m;
let SNMPReceived = CommonSecurityLog
| where TimeGenerated >= HuntStart
| where DestinationPort == 161
| project RecvTime=TimeGenerated,
    RelayIP=DestinationIP,
    OriginalSrc=SourceIP;
let SNMPForwarded = CommonSecurityLog
| where TimeGenerated >= HuntStart
| where SourcePort == 161
    or (DestinationPort == 161
        and isnotempty(SourcePort))
| project FwdTime=TimeGenerated,
    RelayIP=SourceIP,
    FwdTarget=DestinationIP;
SNMPReceived
| join kind=inner SNMPForwarded
    on RelayIP
| where FwdTime > RecvTime
| where FwdTime - RecvTime < Window
| summarize
    RelayCount  = count(),
    FirstSeen   = min(RecvTime),
    LastSeen    = max(FwdTime),
    Sources     = make_set(OriginalSrc),
    Targets     = make_set(FwdTarget)
    by RelayIP
| where RelayCount > 2
| project FirstSeen, LastSeen,
    RelayIP, RelayCount,
    Sources, Targets
| order by RelayCount desc

! Hunt for unexpected static routes
show ip route static
! Compare against authorised route list
! Any route to an unexpected next-hop
! for management subnets is suspicious

! Hunt for policy-based routing
show ip policy
show route-map

! Hunt for unexpected BGP prefixes
! (if BGP is used)
show ip bgp | include \
  "161\|4786\|69\|21"

! Check for SNMP proxy configuration
show running-config | include \
  "snmp-server proxy\|tftp-server\
\|ip forward-protocol"

! Hunt for unexpected NAT rules
show ip nat translations
show ip nat statistics

let HuntStart = ago(30d);
CommonSecurityLog
| where TimeGenerated >= HuntStart
| where DestinationPort in (21, 69, 20)
| where SourceIP startswith "10."
    or SourceIP startswith "172."
    or SourceIP startswith "192.168."
| where DestinationIP !startswith "10."
    and DestinationIP
        !startswith "172."
    and DestinationIP
        !startswith "192.168."
| summarize
    SessionCount = count(),
    BytesSent    = sum(
        toint(SentBytes)),
    FirstSeen    = min(TimeGenerated),
    LastSeen     = max(TimeGenerated),
    Files        = make_set(RequestURL)
    by SourceIP, DestinationIP,
       DestinationPort
| extend ProtocolName = case(
    DestinationPort == 69, "TFTP",
    DestinationPort == 21, "FTP-ctrl",
    DestinationPort == 20, "FTP-data",
    "Unknown")
| project FirstSeen, LastSeen,
    SourceIP, DestinationIP,
    ProtocolName, SessionCount,
    BytesSent, Files
| order by BytesSent desc

! Hunt for TFTP server enabled
show running-config | include \
  "tftp-server"
! Any output here = misconfiguration

! Hunt for FTP server enabled
show running-config | include \
  "ftp-server\|ip ftp"

! Hunt for open UDP/69 listener
show control-plane host open-ports \
  | include 69

! Hunt for file transfer history
! in the syslog buffer
show logging | include \
  "TFTP\|tftp\|FTP\|ftp"

! Check for ip forward-protocol
! (can enable TFTP forwarding)
show running-config | include \
  "ip forward-protocol"

# Hunt for TFTP sessions from
# network device management IPs
tshark -r capture.pcap \
  -Y "udp.port == 69 or \
      tcp.port == 21" \
  -T fields \
  -e frame.time \
  -e ip.src \
  -e ip.dst \
  -e udp.dstport \
  -e tcp.dstport \
  -e tftp.source_file \
  -e ftp.request.command \
  -e ftp.request.arg \
  -E header=y

let HuntStart = ago(30d);
let ChainWindow = 10m;
let ConfigStagingEvents = Syslog
| where TimeGenerated >= HuntStart
| where SyslogMessage has_any (
    "config.bkp","output.txt",
    "copy running-config",
    "Destination filename")
| project StageTime=TimeGenerated,
    Device=Computer,
    StageMsg=SyslogMessage;
let ExfilEvents = CommonSecurityLog
| where TimeGenerated >= HuntStart
| where DestinationPort in (21,69,20)
| where DestinationIP
    !startswith "10."
  and DestinationIP
    !startswith "172."
  and DestinationIP
    !startswith "192.168."
| project ExfilTime=TimeGenerated,
    Device=Computer,
    ExfilDest=DestinationIP,
    ExfilPort=DestinationPort,
    ExfilFile=RequestURL;
ConfigStagingEvents
| join kind=inner ExfilEvents on Device
| where ExfilTime > StageTime
| where ExfilTime - StageTime
    < ChainWindow
| project StageTime, ExfilTime,
    Device, StageMsg,
    ExfilDest, ExfilPort, ExfilFile
| extend
    ChainGapMins = datetime_diff(
        'minute', ExfilTime, StageTime)
| order by StageTime desc

# Hunt TFTP for known exfil filenames
tshark -r capture.pcap \
  -Y "tftp" \
  -T fields \
  -e frame.time \
  -e ip.src \
  -e ip.dst \
  -e tftp.type \
  -e tftp.source_file \
  | grep -iE \
  "config\.bkp|output\.txt|\
running-config|startup-config"

# Hunt FTP for config file transfers
tshark -r capture.pcap \
  -Y "ftp" \
  -T fields \
  -e frame.time \
  -e ip.src -e ip.dst \
  -e ftp.request.command \
  -e ftp.request.arg \
  | grep -iE \
  "STOR|RETR" \
  | grep -iE \
  "config|output|\.bkp|\.cfg"

! Hunt syslog for TFTP transfer events
show logging | include \
  "TFTP\|tftp\|transfer\|config.bkp\
\|output.txt"

! Hunt IP accounting for TFTP flows
! to external destinations
show ip accounting | include \
  "\.69 \|:0045"

! Review full logging buffer for
! the complete kill-chain sequence:
! 1. SNMP Set-Request received
! 2. Copy running-config triggered
! 3. TFTP transfer initiated
show logging last 500 | include \
  "SNMP\|copy\|TFTP\|config"