UAT-8616 Cisco SD-WAN Initial Access via Known Attacker IPs on SSH/NETCONF/vManage API

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

Detects inbound network connections from a specific list of known suspicious or untrusted external IP addresses targeting sensitive management ports (SSH, NETCONF, and vManage-HTTPS-API). The rule identifies if the connection is made by a privileged account (e.g., admin, root) to highlight potential unauthorized management access attempts.