UAT-8616 Cisco SD-WAN SSH Authorized Keys Persistence on vmanage-admin

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•5

Detects unauthorized SSH public key authentication to the vmanage-admin account on Cisco SD-WAN devices. This behavior is indicative of potential unauthorized persistence or account manipulation using SSH keys. The rule also references monitoring for changes to the PermitRootLogin configuration, which is a common indicator of attempts to enable root access via SSH.