UAT-8616 Cisco SD-WAN Log Deletion and File Permission Modification
This rule monitors for unauthorized changes to sensitive system, authentication, and configuration files, as well as the deletion or truncation of logging artifacts on SD-WAN appliances. This activity is indicative of an adversary attempting to modify credentials, evade detection, or clear their footprint by tampering with security-critical paths.
Cortex XDR
