chmod/chown on /etc or /bin paths on Cisco SD-WAN vManage (T1222.002)

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

This rule detects the use of 'chmod' or 'chown' commands on critical system directories ('/etc', '/bin', '/usr', '/sbin') on Cisco vManage, vSmart, and vEdge networking appliances. Such activity could indicate unauthorized modification of system files, persistence attempts, or privilege escalation by an adversary targeting the networking infrastructure.