UAT-8616 vmanage-admin Password Modification on Cisco SD-WAN Manager

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects unauthorized modifications to the vmanage-admin password on Cisco SD-WAN Manager. This rule is designed to identify suspicious credential changes that deviate from standard administrative practices, potentially indicating an actor modifying the default admin credentials for persistence or unauthorized access before attempting to revert the changes to evade detection.