UAT-8616 Cisco SD-WAN vManage REST API Enumeration and evil_tenant.csv Collection

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•3

Detects unauthorized access attempts to sensitive SD-WAN control plane endpoints via REST API or the presence of suspicious 'evil_tenant.csv' artifacts, which may indicate reconnaissance or staging activities.