Sigma rule: Cisco Dot1x Disabled

Rule

Title

Cisco Dot1x Disabled

Status

experimental

Level

medium

Author

Luc Génaux

Date

2026-04-28

File

rules/network/cisco/aaa/cisco_cli_dot1x_disabled.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface.
Disabling dot1x bypasses Network Access Control (NAC) mechanisms, potentially allowing unauthorized devices to gain access to the internal network.
This activity is a common technique used by attackers or malicious insiders to establish persistence or perform lateral movement via rogue devices.

Log source

product

cisco

service

aaa

Detection

keywords:
    # xxx port-control force-authorized : disables 802.1X authentication and causes the port to change to the authorized state without any authentication exchange required
    # no xxx port-control : causes the port to fallback to the default setting which is "force-authorized", thereby disabling 802.1X
    - 'access-session port-control force-authorized' # Modern IOS-XE
    - 'authentication port-control force-authorized' # Older IOS
    - 'dot1x port-control force-authorized' # Legacy
    - 'no access-session port-control' # Modern IOS-XE
    - 'no authentication port-control' # Older IOS
    - 'no dot1x port-control' # Legacy
    - 'no dot1x system-auth-control' # disables 802.1X globally
condition: keywords

False positives (as the rule lists them)

• Administrator troubleshooting connectivity issues

Tags

• attack.persistence
• attack.credential-access
• attack.defense-impairment
• attack.t1685
• attack.t1556.004

MITRE ATT&CK ids this rule names

• T1556.004
• T1685

References

• https://www.cisco.com/en/US/docs/ios-xml/ios/san/command/san-xe-3se-3850-cr-book_chapter_00.html#wp3394428680
• https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-xe-3se-3850-cr-book/sec-a1-xe-3se-3850-cr-book_chapter_010.html#wp3502072400
• https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_53_se/command/reference/2960ComRef/cli1.html#47220

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/network/cisco/aaa/cisco_cli_dot1x_disabled.yml