Cisco SD-WAN Log Tampering Detection

Ethan Andrews@eandrews

•updated Feb 25, 2026•20•1•221

Detects the deletion or clearing of critical Cisco SD-WAN log files. This is a common post-exploitation technique used by attackers to cover their tracks after compromising a device, for instance, after exploiting CVE-2026-20127. The rule identifies direct file deletions and commands used to clear or truncate log file content.