UAT-8616 vmanage-admin Credential Manipulation on Cisco SD-WAN Manager
Detects unauthorized changes to the admin or vmanage-admin user credentials on Cisco SD-WAN Manager. The rule monitors for 'usermod', 'passwd', or AAA password commit commands within the 'vmanage-admin' user context. It specifically identifies a 'change-and-revert' pattern, where the attacker changes a password to gain access and immediately reverts it to evade detection, elevating the risk to critical.
YARA-L
