Cisco SD-WAN File Permission Modification and sshd_config Tampering

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•5

This rule detects potentially malicious modification of sensitive configuration files (e.g., /etc/ssh/sshd_config, /etc/passwd, /etc/shadow) or the execution of chmod/chown commands on sensitive files. It also flags common persistence/backdoor techniques such as modifying SSH settings to allow root login or applying dangerous permissions (777, setuid, setgid) to binaries, which could facilitate privilege escalation.