Abnormal Logs Detected from Cisco Devices in Syslog Server

[samiullah]

Dear Community Team,

I hope this message finds you well.

I have recently observed an influx of logs in our syslog server attributed to "Console user" and "unknown user." After thoroughly investigating, I could not locate these users in our network or configuration settings. Additionally, none of the logs appear to correspond to any actions executed by our network engineers.

I seek your assistance in identifying the cause of these logs and resolving this issue.

Below are examples of the logs frequently appearing for these users:

3557530: Switch: Dec 29 22:02:47: %PARSER-5-CFGLOG_LOGGEDCMD: User: unknown user logged command:!exec: enable
3557505: Switch: Dec 29 22:00:46: %PARSER-5-CFGLOG_LOGGEDCMD: User: unknown user logged command:!exec: enable
3557482: Switch: .Dec 29 21:58:30: %PARSER-5-CFGLOG_LOGGEDCMD: User: unknown user logged command:!exec: enable

&&&&&

84: ABC-Switch: *Dec 30 03:42:17.198: %PARSER-5-CFGLOG_LOGGEDCMD: User: console logged command: transport https
83: ABC-Switch: *Dec 30 03:42:17.198: %PARSER-5-CFGLOG_LOGGEDCMD: User: console logged command: WSMA profile listener HTTPs listener
82: ABC-Switch: *Dec 30 03:42:17.197: %PARSER-5-CFGLOG_LOGGEDCMD: User: console logged command: transport http
81: ABC-Switch: *Dec 30 03:42:17.196: %PARSER-5-CFGLOG_LOGGEDCMD: User: console logged command: WSMA profile listener HTTP listener
80: ABC-Switch: *Dec 30 03:42:17.195: %PARSER-5-CFGLOG_LOGGEDCMD: User: console logged command: WSMA agent notify profile HTTPs listener
79: ABC-Switch: *Dec 30 03:42:17.194: %PARSER-5-CFGLOG_LOGGEDCMD: User: console logged command: WSMA agent notify profile HTTP listener
78: ABC-Switch: *Dec 30 03:42:17.193: %PARSER-5-CFGLOG_LOGGEDCMD: User: console logged command: WSMA agent file sys profile HTTPs listener
77: ABC-Switch: *Dec 30 03:42:17.192: %PARSER-5-CFGLOG_LOGGEDCMD: User: console logged command: WSMA agent file sys profile HTTP listener
76: ABC-Switch: *Dec 30 03:42:17.191: %PARSER-5-CFGLOG_LOGGEDCMD: User: console logged command: WSMA agent config profile HTTPs listener
75: ABC-Switch: *Dec 30 03:42:17.190: %PARSER-5-CFGLOG_LOGGEDCMD: User: console logged command: WSMA agent config profile HTTP listener
74: ABC-Switch: *Dec 30 03:42:17.188: %PARSER-5-CFGLOG_LOGGEDCMD: User: console logged command: WSMA agent exec profile HTTPs listener
73: ABC-Switch: *Dec 30 03:42:17.187: %PARSER-5-CFGLOG_LOGGEDCMD: User: console logged command: WSMA agent exec profile HTTP listener
72: ABC-Switch: *Dec 30 03:42:17.185: %PARSER-5-CFGLOG_LOGGEDCMD: User: console logged command: IP http secure-server

Thank you for your support, and I look forward to your guidance.

[Flavio Miranda]

@samiullah 

 It seems to be automation. It could be EEM script, it could be some Cisco tool like Prime or DNAC, in case you have it. Or any other tool that is able to access your device. Unfortunatelly you are going to need a survey to figure this out.

[samiullah]

@Flavio Miranda 

Thanks for the comment,

The Cisco devices in question are somewhat outdated, and I am concerned that it appears someone may have successfully logged into the network and made changes. However, we have a syslog server configured to receive all logs, including informational-level logs, from these devices. Upon investigation, I found no evidence of any of the mentioned users logging in.

I would like to highlight that we have implemented brute force protection commands to block continuous login attempts. Additionally, we enforce strict ACLs to block external logins and utilize a jump server for accessing these devices.

Unfortunately, we do not currently have an active Cisco support contract to open a case and investigate this issue further.

[Flavio Miranda]

@samiullah 

 I am not sure cisco can tell you what is happening. I would suggest you to put wireshard on the interface that is used to manage the device and keep it runnning for a few hours.

If there are outside attempts to access the device, you might see on the logs.  What you need is make sure this is actually comes from some access attempt or it is something else.

I believe wireshark can tell you this. You can create filters to increase your changes.

[samiullah]

Dear Community Team,

I hope this message finds you well.

Could you please provide any guidance or recommendations to address the issue mentioned above?

Your support in resolving this matter would be greatly appreciated.

Looking forward to your response.