Salt Typhoon - Telecom Edge Device: Unusual CLI Access to Routing Config

Ibrahim Saud@tektrix

•updated Jun 17, 2026•1•0•5

Detects suspicious access to network device configuration files or routing table exports, potentially indicating compromise by the Salt Typhoon threat actor. This rule correlates file access events on critical configuration files (e.g., running-config, startup-config, BGP routes) within sensitive directories with network or remote interactive logons by local administrators.