Detection: Cisco SD-WAN - Arbitrary File Overwrite Exploitation Activity

Updated Date: 2026-05-13 ID: 2f3862c6-45ff-4a02-9bd4-7e25c209fcd9 Author: Nasreddine Bencherchali, Splunk Type: TTP Product: Splunk Enterprise Security

Description

This analytic detects a exploitation activity attempts of targeting Cisco Catalyst SD-WAN Manager. It leverages the "serviceproxy_access.log" and identifies source-host combinations that perform all key stages of the exploitation as reported in public POCs in a short period: authentication/config collection (.dca), upload actions (uploadAck), and payload-style access (.gz/*). The behavior can indicate attempted exploitation activity associated with Cisco Catalyst SD-WAN Manager vulnerabilities CVE-2026-20122 (Arbitrary File Overwrite) and CVE-2026-20128 (Information Disclosure).

Search

 1`cisco_sd_wan_service_proxy_access`
 2
 3| rex field=_raw "^\[.*?\]\s+\"(?<http_method>\S+)\s+(?<uri>\S+)\s+(?<http_protocol>[^\"]+)\"\s+(?<http_response_code>\S+)\s+(?<response_flags>\S+)\s+(?<bytes_in>\S+)\s+(?<bytes_out>\S+)\s+(?<duration>\S+)\s+(?<upstream_service_time>\S+)\s+\"(?<src>[^\"]+)\"\s+\"(?<http_user_agent>[^\"]+)\"\s+\"(?<x_request_id>[^\"]+)\"\s+\"(?<dest>[^\"]+)\"\s+\"(?<upstream_host>[^\"]+)\""
 4
 5| rex field=uri "(?<uri_path>[^\?]+)(?<uri_query>\?.*)?"
 6
 7| eval
 8    http_response_code = tonumber(http_response_code),
 9    bytes_in           = tonumber(bytes_in),
10    bytes_out          = tonumber(bytes_out),
11    duration           = tonumber(duration),
12    upstream_service_time = if(upstream_service_time="-", null(), tonumber(upstream_service_time)),
13    status             = http_response_code,
14    bytes              = bytes_in + bytes_out,
15    http_user_agent_length = len(http_user_agent)
16
17
18| search (
19        (   http_method="POST"
20            uri IN (
21                "*/dataservice/smartLicensing/uploadAck*"
22            )
23        )
24        OR (
25            http_method="GET"
26            uri="*/reports/data/opt/data/containers/config/data-collection-agent/.dca*"
27            )
28        OR (uri="*.gz/*")
29)
30
31
32| eval uri_sequence_steps = case(
33        match(uri, ".*/\.dca"),       "auth",
34        match(uri, ".*/uploadAck"),   "upload",
35        match(uri, ".*\.gz/.*"),      "payload",
36        true(),                       "other"
37)
38
39
40| bin _time span=1m
41
42| stats
43    dc(uri_sequence_steps)        as unique_uri_sequence_steps
44    values(uri)                   as uri
45    values(http_method)           as http_method
46    values(http_user_agent)       as http_user_agent
47    min(_time)                    as firstTime
48    max(_time)                    as lastTime
49by src dest _time
50
51
52| where unique_uri_sequence_steps >= 3
53
54| `security_content_ctime(firstTime)`
55
56| `security_content_ctime(lastTime)`
57
58| sort 0 - firstTime
59
60| `cisco_sd_wan___arbitrary_file_overwrite_exploitation_activity_filter`

Data Source

Name	Platform	Sourcetype	Source
Cisco SD-WAN Service Proxy Access Logs	Other	`'cisco:sdwan:access'`	`'/var/log/nms/containers/service-proxy/serviceproxy-access.log'`

Macros Used

Name	Value
cisco_sd_wan_service_proxy_access	`sourcetype=cisco:sdwan:access`
cisco_sd_wan___arbitrary_file_overwrite_exploitation_activity_filter	`search *`

cisco_sd_wan___arbitrary_file_overwrite_exploitation_activity_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1190	Exploit Public-Facing Application	Initial Access

Delivery

DE.CM

CIS 13

CVE

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	Yes
Rule Title	`%name%`
Rule Description	`%description%`
Notable Event Fields	user, dest
Creates Intermediate Finding (Risk Event)	No

TTP detections generate a Finding (Notable) and may generate Intermediate Findings (Risk Events) for associated entities.

Implementation

This detection requires Cisco SD-WAN Manager Envoy access logs to be ingested into Splunk. These logs are located in "/var/log/nms/containers/service-proxy/serviceproxy-access.log".

Known False Positives

No false positives have been identified at this time.

Associated Analytic Story

Cisco Catalyst SD-WAN Analytics

Finding

Title	Entity Field	Entity Type	Risk Score
Cisco SD-WAN Manager exploitation activity from $src$ has been identified targeting host $dest$.	dest	system	50

Threat Objects

Field	Type
src	ip_address

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`/var/log/nms/containers/service-proxy/serviceproxy-access.log`	`cisco:sdwan:access`
Integration	✅ Passing	Dataset	`/var/log/nms/containers/service-proxy/serviceproxy-access.log`	`cisco:sdwan:access`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 3