UAT-8616 SSH authorized_keys Persistence on Cisco SD-WAN (vManage/vSmart/vBond)
Detects unauthorized persistence mechanisms on Cisco SD-WAN management plane nodes (vManage, vSmart, vBond). The rule monitors for modifications to SSH authorized_keys files, execution of commands like ssh-keygen or user management utilities, and SSH authentication events or configuration changes (e.g., PermitRootLogin) indicative of backdoored access.
Microsoft Sentinel (KQL)
