Cisco Network Config Credentials

Detects credentials and sensitive configuration directives in Cisco IOS/NX-OS configuration files, including enable passwords/secrets, SNMP community strings with write access, PAC keys, and NVRAM/LDAP authentication indicators. Mirrors Snaffler rule KeepNetConfigCreds.

Type

regex

Engine

boost_regex

Confidence

high

Confidence justification

High confidence: the combination of Cisco-specific IOS directives (enable secret, snmp-server community RW, pac key) with network infrastructure corroborative keywords (hostname, interface, ip route) makes false positives extremely unlikely outside genuine Cisco configuration files.

Jurisdictions

global

Regulations

Criminal Code Act 1995 (Cth), Computer Fraud and Abuse Act, Computer Misuse Act 1990

Frameworks

CIS Controls, ISO 27001, NIST CSF

Data categories

credentials, network infrastructure, security

Scope

specific

Risk rating

8

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Unsupported

Pattern

enable\s+(?:password|secret)\s+\S

Corroborative evidence keywords

service password-encryption, hostname, interface, ip route, version 1, no ip domain-lookup, spanning-tree

Proximity: 300 characters

Should match

• hostname CORE-SW1 interface GigabitEthernet0/1 enable secret 5 $1$mERr$hx5rVt7rPNoS4wqbXKX7m0 service password-encryption — High-tier probe - enable secret with device identity and independent IOS config structure
• hostname EDGE-R1 snmp-server community S3cr3tStr RW — Medium-tier probe - write community bound to a named Cisco device
• snmp-server community private view ALL RW — Low-tier probe - write-community directive without independent config context
• aaa new-model pac key 7 045802150C2E1D1C5A — Medium-tier probe - PAC key in Cisco AAA context
• NVRAM config last updated 09:14:23 UTC Mon Jun 10 2024 hostname ROUTER-01 — Low-tier NVRAM inventory marker - never an enforcing credential path
• simple-bind authenticated encrypt ldap-server host 10.1.1.50 — Medium-tier probe - LDAP bind marker with LDAP server structure

Should not match

• the network device must have an enable-secret configured per the security policy — Prose mention of enable-secret requirement without an actual IOS directive (hyphenated, no space before value)
• the snmp-server community string should be changed from the default RW setting — Documentation prose about SNMP without a live community string value
• enable secret — Malformed enable directive has no credential value
• hostname CORE-SW1 interface GigabitEthernet0/1 enable secret CHANGEME service password-encryption — Placeholder enable secret must not enforce
• Documentation example: hostname CORE-SW1 interface GigabitEthernet0/1 enable secret 5 $1$mERr$hx5rVt7rPNoS4wqbXKX7m0 service password-encryption — Documentation quoting a complete IOS fragment must not enforce
• set system root-authentication encrypted-password $6$hash — Sibling Juniper configuration syntax is not a Cisco IOS directive
• hostname EDGE-R1 snmp-server community public RO — Read-only SNMP community is outside the write-credential matcher

Known false positives

• Sanitised configuration exports or documentation samples that include IOS syntax without live credential values. Mitigation: Require proximity to corroborative network keywords (hostname, interface, ip route) to confirm genuine Cisco config context. Template exclusion catches placeholder markers.
• Security hardening guides or audit checklists that quote Cisco commands as examples. Mitigation: The regex requires a non-whitespace character immediately after the enable password/secret keyword, ensuring a value is actually present.

Collections

• Snaffler Parity — Credential & Secret Files