Cisco Dot1x Disabled

Luc Génaux

Detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface. Disabling dot1x bypasses Network Access Control (NAC) mechanisms, potentially allowing unauthorized devices to gain access to the internal network. This activity is a common technique used by attackers or malicious insiders to establish persistence or perform lateral movement via rogue devices.

2026-04-28 00:00:00

None

ef0ff092-a24a-4fbc-beea-06c08d53e085

attack.persistence attack.credential-access attack.defense-impairment attack.t1685 attack.t1556.004

Community Rule

Nasreddine Bencherchali

Merge PR #5966 from @nasbench - Update mitre tags to use attack v19

2026-04-29

EzLucky

Merge PR #5909 from @EzLucky - Add `Cisco Dot1x Disabled`

2026-04-28