Network Device CLI Escape Attempt
A Telnet or SSH session sends the bare words that break out of a router or IoT vendor CLI into a Linux shell (enable, system, shell, sh, linuxshell). Mirai-family bots send this sequence blindly to every device before running their payload. On a honeypot it identifies the bot family; on a real device it means someone is trying to reach the underlying OS.
Tested
Matches all 5 attack events in match.jsonl and none of the 5 look-alike events in nomatch.jsonl. See the test events.
False positives
- Network engineers entering enable mode on real devices (not expected on a honeypot)
Sigma
title: Network Device CLI Escape Attempt
id: 6f1334fc-a6bb-42b6-81f2-0f8ec35050d4
status: experimental
description: |
A Telnet or SSH session sends the bare words that break out of a router or IoT vendor CLI into a
Linux shell (enable, system, shell, sh, linuxshell). Mirai-family bots send this sequence blindly
to every device before running their payload. On a honeypot it identifies the bot family; on a real
device it means someone is trying to reach the underlying OS.
references:
- https://attack.mitre.org/techniques/T1059/008/
author: Estul Lachin
date: 2026-11-08
tags:
- attack.execution
- attack.t1059.008
logsource:
product: cowrie
detection:
selection:
eventid: cowrie.command.input
input|re: '^\s*(enable|system|shell|linuxshell|sh)\s*$'
condition: selection
falsepositives:
- Network engineers entering enable mode on real devices (not expected on a honeypot)
level: lowSplunk SPL
``` Network Device CLI Escape Attempt. Generated from rules/network_device_cli_escape.yml by tools/build.py; do not edit. ```
index=honeypot sourcetype=cowrie:json eventid="cowrie.command.input"
| regex input="^\\s*(enable|system|shell|linuxshell|sh)\\s*$"Microsoft Sentinel KQL
// Network Device CLI Escape Attempt. Generated from rules/network_device_cli_escape.yml by tools/build.py; do not edit.
Cowrie_CL
| where eventid =~ "cowrie.command.input" and input matches regex "^\\s*(enable|system|shell|linuxshell|sh)\\s*$"