UAT-8616 SSH Lateral Movement from Cisco SD-WAN vManage to Controller Components
Detects unauthorized SSH-based lateral movement originating from a compromised Cisco SD-WAN vManage controller to vSmart or vBond components. The rule monitors for SSH sessions initiated by administrative users (admin, vmanage-admin) and subsequent unauthorized file permission modifications (chmod/chown) on sensitive system files and directories, such as SSH authorized_keys and system configuration files, which are indicative of post-exploitation activities.
Sigma
