UAT-8616 Post-Exploitation Command Execution on Cisco SD-WAN Manager (vManage)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

Detects post-exploitation activities on Cisco SD-WAN Manager (vManage) systems. The rule identifies suspicious command execution patterns including shell spawning via SSH, use of administrative/backdoor accounts (troot), privilege escalation attempts using su, enumeration commands commonly used by attackers, unauthorized modification of sensitive system files (/etc/passwd, /etc/shadow), the use of specific malicious tenant-upload CLI operations, and outbound reverse-shell connections.