UAT-8616 SD-WAN Lateral Movement and Post-Exploitation Activity

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•6

This rule monitors Cisco SD-WAN environments for indicators of post-exploitation, including unauthorized SSH lateral movement, abuse of administrative tools (vshell, confd_cli), suspicious tenant list modifications related to CVE-2026-20245, privilege escalation to backdoor accounts, system file tampering (/etc/passwd, /etc/shadow), and anti-forensic activities such as log and history deletion.