Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
23 detections
Filters
Last updated
All Time
Detection languages
7
5
3
3
2
Contributors
19
3
1
Categories
14
12
11
9
6
Platforms
18
11
1
1
1
Products / Services
12
9
7
4
4
MITRE Techniques
16
10
9
8
7
CVEs
71
71
64
58
49
23
Detects the presence of Cisco SD-WAN vManage software, vulnerabilities related to CVE-2026-76504, associated file artifacts, and process executions across endpoints using inventory and event logs.
This rule monitors system and audit logs on network appliances (like Cisco vManage) for unauthorized attempts to escalate privileges to a rogue root user ('troot') and suspicious file manipulation or command execution related to tenant list management, often associated with exploitation of specific vulnerabilities.
This rule detects indicators of exploitation for CVE-2026-20245 in Cisco Catalyst SD-WAN Manager. It monitors for the upload of malicious tenant configuration files, the creation of unauthorized 'troot' administrative accounts, subsequent lateral movement via 'su', modifications to critical system authentication files like /etc/passwd or /etc/shadow, and post-exploitation configuration exfiltration via REST API endpoints.
This rule monitors Cisco SD-WAN environments for indicators of post-exploitation, including unauthorized SSH lateral movement, abuse of administrative tools (vshell, confd_cli), suspicious tenant list modifications related to CVE-2026-20245, privilege escalation to backdoor accounts, system file tampering (/etc/passwd, /etc/shadow), and anti-forensic activities such as log and history deletion.
This rule detects suspicious activity on Linux systems including unauthorized modification of SSH authorized_keys, creation of unauthorized system accounts (e.g., 'troot'), manipulation of critical system files like /etc/passwd or /etc/shadow, and the execution of specific suspicious scripts or commands indicative of an exploit or post-exploitation activity.
Detects signs of unauthorized persistence establishment on Cisco SD-WAN nodes (vManage, vSmart, vBond). This rule monitors for modifications to authorized_keys files, creation of suspicious local accounts (e.g., troot), and configuration changes to permit root SSH logins, which are known tactics used to maintain persistent backdoor access following exploitation.
Detects exploitation of CVE-2026-20245 on Cisco Catalyst SD-WAN Manager, where a malicious CSV file is uploaded via the tenant-list workflow to trigger a script that injects a root-privileged account into system files.
Detects the creation of a root-privileged backdoor account named 'troot' on Cisco SD-WAN nodes (vManage, vSmart, vBond). This rule monitors for process-level indicators such as 'useradd' or 'adduser' usage, manual manipulation of '/etc/passwd' or '/etc/shadow' files, and subsequent 'su' activity or authentication logs associated with the 'troot' account. This pattern aligns with post-exploitation persistence mechanisms observed in UAT-8616 activity.
Detects anomalous bulk configuration data collection from Cisco vManage via REST API endpoints typically used by UAT-8616. The rule identifies repeated HTTP GET requests to critical configuration, device, and system information endpoints on port 8443, which may indicate an attacker attempting to export SD-WAN configuration data following an exploitation event.
Detects malicious browser extensions associated with the StegoAd campaign fetching steganographic payloads (WebP/PNG) from known C2 infrastructure. The detection identifies requests originating from a browser extension context (via Referer header) that target specific image files commonly used by the malware for post-compromise staging and execution guardrail fingerprinting.
Detects the upload and execution of a specific malicious CSV file (evil_tenant.csv) on Cisco SD-WAN Manager (vManage) systems. This file is associated with exploitation of CVE-2026-20245, enabling attackers to inject a persistent root backdoor account into the system files.
Detects the execution of common system enumeration commands (process listing, network configuration, and system information) on Cisco SD-WAN infrastructure nodes. This activity is indicative of post-exploitation reconnaissance used by attackers to understand the system environment, network topology, and identify potential pivot points within the SD-WAN infrastructure.
This rule monitors Linux-based SD-WAN infrastructure (vManage, vSmart, vBond) for suspicious persistence mechanisms, unauthorized account creation, unauthorized SSH key modifications, credential file tampering, and rogue configuration changes related to OMP/IPSec peering and unauthorized tenant-list uploads.
This rule detects the exploitation of CVE-2026-20245 on Cisco SD-WAN Manager (vManage). It monitors for two distinct phases: 1) The suspicious upload of a tenant-list CSV file via CLI using a malicious filename, and 2) A subsequent privilege escalation attempt where the 'admin' user executes 'su' to switch to a 'troot' user, which is indicative of a backdoor account creation following successful exploitation.
Detects unauthorized persistence mechanisms on Cisco SD-WAN Manager, vSmart, and vBond nodes by monitoring for local account creation (e.g., useradd), modification of sensitive authentication files (/etc/passwd, /etc/shadow), and illicit SSH key placement in authorized_keys. This rule specifically monitors for known exploit paths involving the 'troot' account and related command-line activity indicative of unauthorized administrative access.
Detects post-exploitation activities on Cisco SD-WAN Manager (vManage) systems. The rule identifies suspicious command execution patterns including shell spawning via SSH, use of administrative/backdoor accounts (troot), privilege escalation attempts using su, enumeration commands commonly used by attackers, unauthorized modification of sensitive system files (/etc/passwd, /etc/shadow), the use of specific malicious tenant-upload CLI operations, and outbound reverse-shell connections.
Detects suspicious activity on Cisco SD-WAN infrastructure (vManage, vSmart, vBond) associated with unauthorized configuration changes, potential exploitation of CVE-2026-20245, rogue account creation, and anti-forensic behaviors.
Detects post-exploitation activities on SD-WAN appliances, including unauthorized tenant list uploads related to CVE-2026-20245, creation of unauthorized 'troot' accounts in sensitive system files, staging of system files, unauthorized permission modifications via chmod/chown, and privilege escalation attempts using su.
Detects indicators of exploitation related to CVE-2026-20245 on Cisco Catalyst SD-WAN controllers, including malicious tenant CSV uploads, unauthorized account creation (troot), privilege escalation via su, anti-forensic backup of system configuration files, and configuration changes such as PermitRootLogin enabled.
Detects suspicious authentication and management events associated with SD-WAN devices, specifically targeting indicators of CVE-2026-20245 exploitation. The rule monitors for unauthorized SSH access, usage of tenant-upload commands, execution of rogue scripts like vconfd_script_upload_tenant_list, and anomalous peering activity indicative of device injection.
This rule detects management log entries in Cisco SD-WAN that indicate a potentially malicious file path being used during a CSV upload. Such crafted uploads have been exploited in real-world attacks to execute commands on network appliances. Detection of this activity suggests a compromise attempt or successful exploitation. It is recommended to block and audit the source account, investigate the user's recent activities (e.g., new software installations, clicked links), and involve the security team for further analysis.
Page 1 of 2