Cisco ASA - New Local User Account Created

SPLUNK detection rule by Nasreddine Bencherchali, Splunk · Apache-2.0

This analytic detects creation of new user accounts on Cisco ASA devices via CLI or ASDM. Adversaries may create unauthorized user accounts to establish persistence, maintain backdoor access, or elevate privileges on network infrastructure devices. These rogue accounts can provide attackers with continued access even after initial compromise vectors are remediated. The detection monitors for ASA message ID 502101, which is generated whenever a new user account is created on the device, capturing details including the username, privilege level, and the administrator who created the account. Investigate unexpected account creations, especially those with elevated privileges (level 15), accounts created outside business hours, accounts with suspicious or generic names, or accounts created by non-administrative users.

name: Cisco ASA - New Local User Account Created
id: 9c8e4f2a-7d3b-4e5c-8a9f-1b6d4e8c3f5a
version: 5
creation_date: '2025-11-21'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |
    This analytic detects creation of new user accounts on Cisco ASA devices via CLI or ASDM.
    Adversaries may create unauthorized user accounts to establish persistence, maintain backdoor access, or elevate privileges on network infrastructure devices. These rogue accounts can provide attackers with continued access even after initial compromise vectors are remediated.
    The detection monitors for ASA message ID 502101, which is generated whenever a new user account is created on the device, capturing details including the username, privilege level, and the administrator who created the account.
    Investigate unexpected account creations, especially those with elevated privileges (level 15), accounts created outside business hours, accounts with suspicious or generic names, or accounts created by non-administrative users.
data_source:
    - Cisco ASA Logs
search: |
    `cisco_asa`
    message_id IN (502101)
    | fillnull
    | stats count earliest(_time) as firstTime
            latest(_time) as lastTime
            values(action) as action
            values(message_id) as message_id
            values(result) as result
            values(privilege_level) as privilege_level
      by host user
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_asa___new_local_user_account_created_filter`
how_to_implement: |
    This search requires Cisco ASA syslog data to be ingested into Splunk via the Cisco Security Cloud TA.
    To ensure this detection works effectively, configure your ASA and FTD devices to generate and forward message ID 502101.
    If your logging level is set to 'Notifications' or higher, these messages should already be included, else we recommend setting an event list that keeps the severity level you are using and adds message ID 502101.
    You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html.
    You can also change the severity level of the above message id's to the syslog level you have currently enabled using the logging message syslog_id level severity_level command in global configuration mode. For more information, see Change the Severity Level of a Syslog Message : https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/monitor-syslog.html#ID-2121-000006da
known_false_positives: |
    Legitimate account creation occurs during employee onboarding, contractor provisioning, service account setup, or emergency access. Verify against HR records and change management tickets.
    Filter known admin accounts during business hours.
references:
    - https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/asa-syslog/syslog-messages-500000-to-520025.html#con_4773963
drilldown_searches:
    - name: View the detection results for $host$
      search: '%original_detection_search% | search  host = $host$'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for $host$
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: New local user account $user$ with privilege level $privilege_level$ was created on Cisco ASA host $host$.
        - field: user
          type: user
          score: 20
          message: New local user account $user$ with privilege level $privilege_level$ was created on Cisco ASA host $host$.
analytic_story:
    - Suspicious Cisco Adaptive Security Appliance Activity
asset_type: Network
mitre_attack_id:
    - T1136.001
    - T1078.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: network
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_asa/generic/cisco_asa_generic_logs.log
          source: not_applicable
          sourcetype: cisco:asa
      test_type: unit

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

3ee64b9d-911a-4b4a-b319-faadf98edbcb

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion