SSH authorized key injection on Cisco SD-WAN vmanage-admin or root accounts

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

This rule detects modifications to SSH authorized_keys files on Linux-based SD-WAN controllers, or successful SSH public key authentication events involving the vmanage-admin user, including attempts to identify authentication from unexpected source IP addresses.