UAT-8616 SSH authorized_keys Modification on Cisco SD-WAN Nodes

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•5

Detects signs of unauthorized persistence establishment on Cisco SD-WAN nodes (vManage, vSmart, vBond). This rule monitors for modifications to authorized_keys files, creation of suspicious local accounts (e.g., troot), and configuration changes to permit root SSH logins, which are known tactics used to maintain persistent backdoor access following exploitation.