UAT-8616 Log Manipulation and Deletion on Cisco SD-WAN Controllers

Ethan Andrews@eandrews

•updated Jun 25, 2026•0•0•4

This rule identifies suspicious command-line activity indicative of log manipulation, truncation, or deletion on Cisco SD-WAN controllers. It monitors for the execution of utilities like 'rm', 'shred', 'truncate', 'bash', 'cat', and 'echo' targeting critical system logs, including '/var/log/auth.log' and various 'vdebug' log files. By detecting these anti-forensic techniques, the rule flags potential attempts by adversaries to conceal post-exploitation activity or clear audit trails.