UAT-8616 chmod File Permission Modification on Cisco SD-WAN Controller

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

Detects the use of the 'chmod' command to modify file permissions on critical system directories or files such as /etc/passwd, /etc/shadow, and various log directories. This activity is often indicative of an adversary attempting to facilitate privilege escalation, maintain persistence, or hide malicious artifacts.