Detection: Cisco SD-WAN - Arbitrary File Overwrite Exploitation Activity

Updated Date: 2026-03-09 ID: 2f3862c6-45ff-4a02-9bd4-7e25c209fcd9 Author: Nasreddine Bencherchali, Splunk Type: TTP Product: Splunk Enterprise Security

Description

This analytic detects a exploitation activity attempts of targeting Cisco Catalyst SD-WAN Manager. It leverages the "serviceproxy_access.log" and identifies source-host combinations that perform all key stages of the exploitation as reported in public POCs in a short period: authentication/config collection (.dca), upload actions (uploadAck), and payload-style access (.gz/*). The behavior can indicate attempted exploitation activity associated with Cisco Catalyst SD-WAN Manager vulnerabilities CVE-2026-20122 (Arbitrary File Overwrite) and CVE-2026-20128 (Information Disclosure).

Search

 1`cisco_sd_wan_service_proxy_access`
 2
 3| rex field=_raw "^\[.*?\]\s+\"(?<http_method>\S+)\s+(?<uri>\S+)\s+(?<http_protocol>[^\"]+)\"\s+(?<http_response_code>\S+)\s+(?<response_flags>\S+)\s+(?<bytes_in>\S+)\s+(?<bytes_out>\S+)\s+(?<duration>\S+)\s+(?<upstream_service_time>\S+)\s+\"(?<src>[^\"]+)\"\s+\"(?<http_user_agent>[^\"]+)\"\s+\"(?<x_request_id>[^\"]+)\"\s+\"(?<dest>[^\"]+)\"\s+\"(?<upstream_host>[^\"]+)\""
 4
 5| rex field=uri "(?<uri_path>[^\?]+)(?<uri_query>\?.*)?"
 6
 7| eval
 8    http_response_code = tonumber(http_response_code),
 9    bytes_in           = tonumber(bytes_in),
10    bytes_out          = tonumber(bytes_out),
11    duration           = tonumber(duration),
12    upstream_service_time = if(upstream_service_time="-", null(), tonumber(upstream_service_time)),
13    status             = http_response_code,
14    bytes              = bytes_in + bytes_out,
15    http_user_agent_length = len(http_user_agent)
16
17
18| search (
19        (   http_method="POST"
20            uri IN (
21                "*/dataservice/smartLicensing/uploadAck*"
22            )
23        )
24        OR (
25            http_method="GET"
26            uri="*/reports/data/opt/data/containers/config/data-collection-agent/.dca*"
27            )
28        OR (uri="*.gz/*")
29)
30
31
32| eval uri_sequence_steps = case(
33        match(uri, ".*/\.dca"),       "auth",
34        match(uri, ".*/uploadAck"),   "upload",
35        match(uri, ".*\.gz/.*"),      "payload",
36        true(),                       "other"
37)
38
39
40| bin _time span=1m
41
42| stats
43    dc(uri_sequence_steps)        as unique_uri_sequence_steps
44    values(uri)                   as uri
45    values(http_method)           as http_method
46    values(http_user_agent)       as http_user_agent
47    min(_time)                    as firstTime
48    max(_time)                    as lastTime
49by src dest _time
50
51
52| where unique_uri_sequence_steps >= 3
53
54| `security_content_ctime(firstTime)`
55
56| `security_content_ctime(lastTime)`
57
58| sort 0 - firstTime
59
60| `cisco_sd_wan___arbitrary_file_overwrite_exploitation_activity_filter`

Data Source

Name	Platform	Sourcetype	Source
Cisco SD-WAN Service Proxy Access Logs	Other	`'cisco:sdwan:access'`	`'/var/log/nms/containers/service-proxy/serviceproxy-access.log'`

Macros Used

Name	Value
cisco_sd_wan_service_proxy_access	`sourcetype=cisco:sdwan:access`
cisco_sd_wan___arbitrary_file_overwrite_exploitation_activity_filter	`search *`

cisco_sd_wan___arbitrary_file_overwrite_exploitation_activity_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1190	Exploit Public-Facing Application	Initial Access

Delivery

DE.CM

CIS 13

CVE

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Notable	Yes
Rule Title	`%name%`
Rule Description	`%description%`
Notable Event Fields	user, dest
Creates Risk Event	True

This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.

Implementation

This detection requires Cisco SD-WAN Manager Envoy access logs to be ingested into Splunk. These logs are located in "/var/log/nms/containers/service-proxy/serviceproxy-access.log".

Known False Positives

No false positives have been identified at this time.

Associated Analytic Story

Cisco Catalyst SD-WAN Analytics

Risk Based Analytics (RBA)

Risk Message:

Cisco SD-WAN Manager exploitation activity from $src$ has been identified targeting host $dest$.

Risk Object	Risk Object Type	Risk Score	Threat Objects
dest	system	50	src

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`/var/log/nms/containers/service-proxy/serviceproxy-access.log`	`cisco:sdwan:access`
Integration	✅ Passing	Dataset	`/var/log/nms/containers/service-proxy/serviceproxy-access.log`	`cisco:sdwan:access`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1