Detection rules › Splunk
Cisco SD-WAN Multiple Source IP vManage Admin SSH Authentication
This analytic identifies multiple unique source IP addresses successfully authenticating as vmanage-admin via SSH publickey on Cisco Catalyst SD-WAN control components within a short time window. This aligns with IoC guidance for CVE-2026-20127 (cisco-sa-sdwan-rpa-EHchtZk), which warns that compromised systems may show Accepted publickey for vmanage-admin entries from unauthorized IPs. Validate flagged source IPs against known System IPs in SD-WAN Manager and investigate unexpected or concurrent sources.
Known false positives
- No false positives have been identified at this time.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Reconnaissance |
Rule body
name: Cisco SD-WAN Multiple Source IP vManage Admin SSH Authentication
id: 7882ec59-0e5b-4899-bd1a-7f9b16078bd4
version: 1
creation_date: '2026-06-09'
modification_date: '2026-06-09'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: |-
This analytic identifies multiple unique source IP addresses successfully authenticating as `vmanage-admin` via SSH publickey on Cisco Catalyst SD-WAN control components within a short time window.
This aligns with IoC guidance for CVE-2026-20127 (cisco-sa-sdwan-rpa-EHchtZk), which warns that compromised systems may show `Accepted publickey for vmanage-admin` entries from unauthorized IPs.
Validate flagged source IPs against known System IPs in SD-WAN Manager and investigate unexpected or concurrent sources.
data_source:
- Cisco SD-WAN Auth Log
search: |-
`cisco_sd_wan_syslog`
"Accepted publickey"
| rex field=_raw "^(?<event_timestamp>\S+)\s+(?<dest>\S+)\s+<auth\.info>\s+sshd\[\d+\]:\s+Accepted publickey for (?<user>\S+) from (?<src>\S+) port (?<src_port>\d+) ssh2:\s+(?<key_type>\S+)\s+(?<ssh_key>\S+)"
| where user="vmanage-admin"
| bin event_timestamp span=2m
| stats dc(src) as unique_src_ips
values(src) as src_ips
values(user) as users
count as auth_count by event_timestamp dest
| where unique_src_ips >= 2
| sort 0 - unique_src_ips
| `cisco_sd_wan_multiple_source_ip_vmanage_admin_ssh_authentication_filter`
how_to_implement: |
This detection requires Cisco SD-WAN auth logs from the /var/log/auth.log file to be ingested into Splunk.
known_false_positives: |
No false positives have been identified at this time.
references:
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk
analytic_story:
- Cisco Catalyst SD-WAN Analytics
asset_type: Network
cve:
- CVE-2026-20127
mitre_attack_id:
- T1595
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
category: application
security_domain: network
Stages and Predicates
Stage 1: search
`cisco_sd_wan_syslog`
"Accepted publickey"
Stage 2: rex
| rex field=_raw "^(?<event_timestamp>\S+)\s+(?<dest>\S+)\s+<auth\.info>\s+sshd\[\d+\]:\s+Accepted publickey for (?<user>\S+) from (?<src>\S+) port (?<src_port>\d+) ssh2:\s+(?<key_type>\S+)\s+(?<ssh_key>\S+)"
Stage 3: where
| where user="vmanage-admin"
Stage 4: bucket
| bin event_timestamp span=2m
Stage 5: stats
| stats dc(src) as unique_src_ips
values(src) as src_ips
values(user) as users
count as auth_count by event_timestamp dest
Stage 6: where
| where unique_src_ips >= 2
Stage 7: sort
| sort 0 - unique_src_ips
Stage 8: search
| `cisco_sd_wan_multiple_source_ip_vmanage_admin_ssh_authentication_filter`
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
sourcetype | eq |
| field:"sourcetype" kind:eq value:"cisco:sdwan:syslog" |
unique_src_ips | ge |
| field:"unique_src_ips" kind:ge value:"2" |
user | eq |
| field:"user" kind:eq |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "Accepted publickey" |