UAT-8616 SD-WAN Post-Exploitation Cleanup Validation Script on vManage

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

This rule detects suspicious command-line activity where shell interpreters (bash, sh, dash, python) are used to search for or interact with potentially sensitive system files, such as password files or custom indicators of compromise like 'evil_tenant'. The query targets grep, find, ls, and echo commands used to locate or confirm the existence of these sensitive artifacts.