Name:Cisco SD-WAN Multiple Source IP vManage Admin SSH Authentication id:7882ec59-0e5b-4899-bd1a-7f9b16078bd4 version:1 date:None author:Teoderick Contreras, Splunk status:production type:Hunting Description:This analytic identifies multiple unique source IP addresses successfully authenticating as `vmanage-admin` via SSH publickey on Cisco Catalyst SD-WAN control components within a short time window.
This aligns with IoC guidance for CVE-2026-20127 (cisco-sa-sdwan-rpa-EHchtZk), which warns that compromised systems may show `Accepted publickey for vmanage-admin` entries from unauthorized IPs.
Validate flagged source IPs against known System IPs in SD-WAN Manager and investigate unexpected or concurrent sources. Data_source:
-Cisco SD-WAN Auth Log
search:`cisco_sd_wan_syslog` "Accepted publickey" | rex field=_raw "^(?<event_timestamp>\S+)\s+(?<dest>\S+)\s+<auth\.info>\s+sshd\[\d+\]:\s+Accepted publickey for (?<user>\S+) from (?<src>\S+) port (?<src_port>\d+) ssh2:\s+(?<key_type>\S+)\s+(?<ssh_key>\S+)" | where user="vmanage-admin" | bin event_timestamp span=2m | stats dc(src) as unique_src_ips values(src) as src_ips values(user) as users count as auth_count by event_timestamp dest | where unique_src_ips >= 2 | sort 0 - unique_src_ips | `cisco_sd_wan_multiple_source_ip_vmanage_admin_ssh_authentication_filter`
