Salt Typhoon Network Device Persistence via Unusual CLI Commands
Detects administrative commands (e.g., showing running configuration, copying startup configuration, or accessing enable secret) executed via SSH or Telnet on network devices from non-baseline management IP addresses.
Splunk (SPL)
