UAT-8616 SSH Lateral Movement from vManage to SD-WAN Fabric Components

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects unusual SSH activity originating from or involving Cisco vManage systems, specifically monitoring outbound SSH connections to internal network segments (10.0.0.0/8) or the execution of SSH processes with command-line arguments indicative of management tasks (vsmart, vbond).