Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9 detections
Filters
Last updated
All Time
Detection languages
2
2
2
1
1
Contributors
7
1
1
Categories
5
4
3
3
3
Platforms
7
4
1
1
Products / Services
7
3
1
1
1
MITRE Techniques
6
5
4
4
4
CVEs
71
71
64
58
49
Detects the presence of Cisco SD-WAN vManage software, vulnerabilities related to CVE-2026-76504, associated file artifacts, and process executions across endpoints using inventory and event logs.
Detects anomalous access to Cisco SD-WAN Manager (vManage) infrastructure. This includes unauthenticated REST API access, unauthorized NETCONF sessions, and suspicious OMP/DTLS peering connections, which may indicate exploitation of vulnerabilities (such as CVE-2026-20127 or CVE-2026-20182) or unauthorized management access.
Detects malicious activities targeting Cisco Catalyst SD-WAN infrastructure, including connections from known malicious IP addresses (UAT-8616), unauthenticated vManage API access attempts indicative of exploitation (CVE-2026-20182), and anomalous control-plane signaling (OMP/DTLS/NETCONF) from unauthorized external sources.
Detects exploitation attempts against the Flowise Model Context Protocol (MCP) environment, specifically targeting the node_options case-sensitivity bypass (CVE-2026-20182). The rule monitors for malicious node child process spawning, command line injection via the --require flag, suspicious file creation (flowise_marker.txt), and unauthorized outbound network connections from the Flowise process.
Detects network activity and successful administrative logins to Cisco SD-WAN vManage devices originating from IPs associated with threat actor UAT-8616. The rule also flags any successful vmanage-admin logins originating from outside known trusted management network ranges, which may indicate exploitation of CVE-2026-20127 or CVE-2026-20182.
Detects a suspicious sequence of events where a user successfully authenticates via SSH to a Cisco SD-WAN Manager (vManage) using the 'vmanage-admin' account, followed by REST API calls to enumerate device inventory (vedges or controllers) from the same source IP within 30 minutes. This behavior is indicative of potential post-exploitation activity or reconnaissance associated with the UAT-8616 campaign.
Detects successful SSH authentication to administrative accounts ('vmanage-admin' or 'admin') on Cisco Catalyst SD-WAN Manager (vManage) devices originating from IP addresses associated with the threat actor UAT-8616. This activity relates to exploits targeting CVE-2026-20127 and CVE-2026-20182 for unauthorized access via authentication bypass or certificate abuse.
Detects the unauthorized addition or peering of rogue devices within a Cisco SD-WAN fabric. This rule monitors vManage and vBond logs for successful peering or registration events that correlate with known rogue indicators, such as certificate validation failures, mismatching system information, or untrusted peer identities. This activity is often indicative of attackers attempting to gain persistent control over the SD-WAN infrastructure, potentially using authentication bypass vulnerabilities or stolen credentials.
Detects modifications to /home/vmanage-admin/.ssh/authorized_keys on Cisco SD-WAN controllers (vSmart, vManage, vBond) by any process. This file is a post-exploitation persistence target documented by Resecurity and Rapid7 for CVE-2026-20182. Legitimate modifications to this file are extremely rare in production SD-WAN deployments, as the vmanage-admin account is an internal service account and its authorized_keys file is provisioned during initial deployment and rarely touched afterward. Any write event is worth immediate investigation.
