UAT-8616 Anti-Forensic Log Deletion on Cisco SD-WAN Controllers

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•3

This rule monitors for suspicious file operations on Cisco vManage, vSmart, and vBond network devices. It detects attempts to delete system logs, unauthorized access or copying of sensitive system files (such as /etc/passwd or /etc/shadow), and the presence of suspicious strings in command lines that may indicate anti-forensic activity or the creation of rogue accounts.