[darthsteven444-code]

Detects %SEC_LOGIN-1-QUIET_MODE_ON, emitted when a Cisco IOS device enters quiet mode after exceeding the configured login failure threshold.

Summary of the Pull Request

Adds a detection for %SEC_LOGIN-1-QUIET_MODE_ON, which a Cisco IOS device emits when it enters quiet mode after exceeding the configured login failure threshold (login block-for <sec> attempts <n> within <sec>).

Existing coverage under rules/network/cisco/aaa/ is built around CLI command keywords (clear logs, discovery, DoS, config modification). There is currently no rule covering an authentication brute force against the device management plane itself. The closest existing auth related rule is cisco_bgp_md5_auth_failed, which covers BGP peering rather than device login.

Quiet mode is only entered after repeated failures inside the configured window, so the event is thresholded by the device itself. That makes it a high confidence signal without needing aggregation or count logic in the rule, and it avoids alerting on a single mistyped password.

Validation: sigma check passes with 0 errors and 0 issues. The rule was written against real telemetry from a Cisco 2911 running IOS 15.7(3)M8 with syslog forwarded into a SIEM. Status is experimental per the contribution conventions for new rules.

Changelog

new: Cisco IOS Login Brute Force Quiet Mode Triggered

Example Log Event

%SEC_LOGIN-1-QUIET_MODE_ON: Still timeleft for watching failures is 110 seconds, [user: admin] [Source: 10.0.0.5] [localport: 22] [Reason: Login Authentication Failed] [ACL: sl_def_acl] at 20:09:06 CDT Sun Oct 18 2026

Fixed Issues

None.

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[github-actions]

Welcome @darthsteven444-code 👋

It looks like this is your first pull request on the Sigma rules repository!

Please read the SigmaHQ conventions to ensure your contribution adheres to best practices and includes all the necessary elements for a successful review.

Also check CONTRIBUTING.md for more information on how to contribute to the Sigma rules repository, specifically proper testing and validation of your rules.

Thanks again, and welcome to the Sigma community! 😃

If you want to engage more with the community for official support, general discussions or announcements:

👉 Join our Discord server