UAT-8616 Log Tampering and Artifact Removal on Cisco SD-WAN Infrastructure
Detects evidence of post-exploitation anti-forensic activity on Cisco SD-WAN components (vManage, vSmart, vBond). This rule monitors for unauthorized removal of logs and exploitation artifacts, the clearing of shell command history, and suspicious modification of file and directory permissions on critical system paths.
Sigma
