UAT-8616 Cisco SD-WAN Admin Password Change and Reversion via NETCONF
Detects rapid successive password changes to the default 'admin' account on Cisco SD-WAN controllers followed by a configuration rollback. This pattern indicates an adversary attempting to temporarily modify credentials for exploitation while attempting to evade detection by reverting to the original configuration state, specifically targeting NETCONF configuration commits.
Microsoft Sentinel (KQL)
