UAT-8616 SSH Lateral Movement from Cisco SD-WAN vmanage-admin Account

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•3

Detects SSH network connections initiated by common administrative service accounts 'vmanage-admin' or 'troot' using the ssh or sshd process. This pattern may indicate unauthorized use of these service accounts or anomalous remote access behavior.