Cisco IOS-XE GRE Tunnel C2 via TCL Injection and SSH to 62.171.185.97

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

This rule detects unauthorized configuration of GRE tunnels on Cisco IOS-XE network devices, potentially indicating persistent command and control (C2) channel establishment via TCL injection or illicit configuration changes involving known attacker infrastructure (62.171.185.97). It correlates network traffic to the attacker IP with process-level activity involving suspicious configuration files, scripts, or device-specific command-line arguments.