--- analysis: A static rule might fire on any write to /etc/sv, but this hunt provides the vital context of a specific filesystem remount (defense evasion) combined with fleet prevalence counting to distinguish targeted APT tampering from vendor firmware updates. blind_spots: - id: auditd-unconfigured owner: Cloud Infrastructure Team question: whether the remount command was executed remediation: Enable syscall auditing for 'mount' across the SD-WAN controller fleet. requires: hb_linux_audit with SYSCALL:mount monitoring risk: If auditd is not configured to log the mount syscall, the lead query will return zero rows, and the gate will close even if the controller is compromised. stage: defense-evasion-remount-rootfs - id: overlay-fs-complexity question: what precise changes were made to the overlay when the remount occurred requires: Deep inspection of overlay filesystem changes risk: File activity logs might show the write, but the relationship between the remount and the write is temporal, not causal in the logs; an analyst must manually link them. stage: persistence-runit-service-tampering coverage: - reason: The peering authentication bypass occurs within the proprietary SD-WAN control plane; it does not leave standard authentication logs on the listed surfaces. stage: initial-access-cisco-auth-bypass status: not_visible - stage: persistence-runit-service-tampering status: covered steps: - script-tampering - rare-scripts - stage: defense-evasion-remount-rootfs status: covered steps: - lead-remount - reason: 'Belongs to another part of the ''Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN'' series.' stage: execution-injection-ptrace status: out_of_scope - reason: 'Belongs to another part of the ''Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN'' series.' stage: collection-in-process-hooking status: out_of_scope - reason: 'Belongs to another part of the ''Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN'' series.' stage: exfiltration-in-band-c2 status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: Cisco SD-WAN controllers are the trust anchor of the enterprise network. A compromise here allows an adversary to intercept all control traffic and extract data-plane encryption keys, rendering the network's confidentiality void. methodology: model-assisted trigger: intel-report hypothesis: An adversary has exploited a Cisco SD-WAN authentication bypass to establish persistence by modifying runit service scripts and remounting the root filesystem as executable to facilitate malware deployment. labels: - hunt - attack.t1190 - attack.t1037 - attack.t1543 - attack.t1574.006 - attack.t1036.004 - collection - defense evasion - execution - exfiltration - initial access - persistence name: Cisco SD-WAN Controller Service Tampering parameters: lookback_days: default: '14' description: Days of history to examine for process and file activity. type: number scope_hosts: default: [] description: Specific hostnames to focus on, typically those identified in the scoping lead. type: list[host] target_paths: default: - /etc/sv/sshd/run - /etc/sv/aaamgr/run - /etc/pam.d/sshd - /etc/pam.d/login description: Runit service scripts and PAM configurations targeted for tampering. from: kind: article observed: '2026-10-28' ref: uat-11473-keydrift type: list[path] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://blog.talosintelligence.com/uat-11473-keydrift/ gates: - dry-run - lint - critic model: hb_google/gemini-3-flash-preview rationale: Focus on Cisco Catalyst SD-WAN Controller instances (vSmart, vManage, vBond). These typically run a specific Linux-based firmware. Remounting /rootfs.rw as executable is a rare administrative action. references: - name: 'Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN' url: https://blog.talosintelligence.com/uat-11473-keydrift/ related: - hunt: keydrift-ptrace-injection reason: Once persistence is established via service tampering, the malware framework typically proceeds to inject into vdaemon using ptrace. relation: follows scenario: stages: - name: Cisco SD-WAN Authentication Bypass observables: - CVE-2026-20127 - Cisco SD-WAN Catalyst Controller slug: initial-access-cisco-auth-bypass tactic: initial-access techniques: - T1190 - name: Runit Service Launcher Modification observables: - /etc/sv/sshd/run - /etc/sv/aaamgr/run - deletion of writable-overlay PAM configurations - invocation of malicious run scripts before legitimate service start slug: persistence-runit-service-tampering tactic: persistence techniques: - T1037 - T1543 - name: Rootfs Executable Remounting observables: - remount /rootfs.rw as executable - mount -o remount,exec /rootfs.rw slug: defense-evasion-remount-rootfs tactic: defense-evasion techniques: - T1574.006 - name: Process Injection and PID Enumeration observables: - conf_sshd script execution - rsshd injector execution - aaamgrd packed loader execution - ptrace system calls against vdaemon processes - /tmp/system-vdaemon - enumeration of vdaemon PIDs slug: execution-injection-ptrace tactic: execution techniques: - T1055.008 - T1059.004 - T1036.004 - name: Control-Plane Interception Hooking observables: - libdssl.so (PolyFlame) - libcommon.so (LittleFilch) - hooking of SSL_read inside vdaemon - hooking of recvfrom, sendto, and dlopen in vdaemon - interposition of runtime-linker behavior slug: collection-in-process-hooking tactic: collection techniques: - T1574.006 - name: Telemetry Staging and C2 Exfiltration observables: - /var/tmp/vdaemon.bin (RSA-encrypted telemetry) - /var/tmp/vdaemon.conf (Endpoint configuration) - UDP exfiltration in DTLS 1.2 style records - TinyShell command codes 0x100, 0x200, 0x300 slug: exfiltration-in-band-c2 tactic: exfiltration techniques: - T1041 summary: UAT-11473 exploited an authentication bypass vulnerability (CVE-2026-20127) in Cisco SD-WAN Catalyst Controllers to gain unauthorized administrative access. The threat actor established persistence by modifying runit service scripts to launch the KeyDrift framework, which uses ptrace injection and runtime hooking to intercept sensitive control-plane keying material and exfiltrate it over UDP. series: index: 1 slug: inside-keydrift-analyzing-historical-uat-11473-activity-on-cisco-sd-wan title: 'Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN' total: 2 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent tlp: clear type: investigation --- # Cisco SD-WAN Controller Service Tampering The adversary exploits a Cisco SD-WAN authentication bypass to modify runit service scripts and remount the root filesystem as executable. This hunt identifies the initial remounting of the /rootfs.rw filesystem, a mandatory step for the attacker to write to the underlying OS. If suspicious remounting is identified, the hunt fans out to examine modifications to runit service launchers and stack-counts these changes across the fleet to highlight rare, malicious patterns that deviate from standard Cisco firmware behavior. An agent weighs the combined evidence to identify compromised controllers before an analyst initiates containment. ## lead-remount Identify the critical defense evasion step where /rootfs.rw is remounted as executable to allow malicious scripts to run. ```sqlite target=endpoint role=scoping params=(lookback_days=lookback_days) ~~~yaml expected: A mount syscall targeting /rootfs.rw with the 'exec' option. Silence indicates no such remounting was captured during the window. reads: - device_hostname - process_path - path_name - raw_record - time - record_type - syscall silence: not_evidence_of_absence source: hb_linux_audit verified: dry-run verified_at: '2026-10-29' ~~~ SELECT device_hostname, process_path, path_name, raw_record, time FROM hb_linux_audit WHERE record_type = 'SYSCALL' AND syscall = 'mount' AND (LOWER(raw_record) LIKE '%remount%' AND LOWER(raw_record) LIKE '%exec%' AND LOWER(raw_record) LIKE '%/rootfs.rw%') AND time >= datetime('now', '-{{lookback_days}} days') ``` ## gate-agent ```agent target=hunter cite: required context: - lead-remount max_iterations: 3 objective: Evaluate the context of the mount syscall; determine if /rootfs.rw was remounted specifically with executable flags outside of a standard update window. success_criteria: A verdict of suspicious or benign for every host found in the lead. tools: - endpoint ``` ## gate-decision if~: "the gate-agent verdict is suspicious or malicious for at least one host" (confidence: high, judge=hunter) then: → fan-out-tampering indeterminate: → forensic-task unavailable: → forensic-task (blind_spot: auditd-unconfigured) else: → close-out-task ## fan-out-tampering parallel: - → script-tampering - → rare-scripts join: → triage-agent ## script-tampering Detect modifications to the specific runit service scripts and PAM configurations described in the KeyDrift staging. ```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts, target_paths=target_paths) ~~~yaml expected: File writes or modifications to runit run scripts or PAM configuration files. Silence suggests no tampering occurred on those paths. reads: - device_hostname - process_name - file_path - activity_name - time - activity_id silence: not_evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-10-29' ~~~ SELECT device_hostname, process_name, file_path, activity_name, time FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{target_paths}}' || ',', ',' || LOWER(file_path) || ',') > 0 AND activity_id IN (1, 3, 4, 5) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## rare-scripts Stack-count all runit script modifications to highlight those unique to a small number of hosts. ```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Runit script paths modified on only one or two hosts. Fleet-wide changes are likely legitimate firmware updates. prevalence: by: device_hostname key: - script_path rare_below: 3 reads: - file_path - device_hostname - activity_id - time silence: not_evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-10-29' ~~~ SELECT LOWER(file_path) AS script_path, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS write_events, MIN(time) AS first_seen FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND LOWER(file_path) LIKE '/etc/sv/%/run' AND activity_id IN (1, 3) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1 HAVING host_count <= 3 ORDER BY host_count ASC ``` ## triage-agent ```agent target=hunter cite: required context: - gate-agent - script-tampering - rare-scripts max_iterations: 5 objective: Determine if the sequence of remounting /rootfs.rw followed by modifications to service scripts indicates a KeyDrift infection. Use prevalence data to rule out legitimate maintenance. success_criteria: A final verdict citing the alignment between the observed behavior and the UAT-11473 staging pattern. tools: - endpoint ``` ## route-decision if~: "the triage-agent verdict is malicious for at least one host" (confidence: high, judge=hunter) then: → isolate-action indeterminate: → forensic-task unavailable: → forensic-task else: → close-out-task ## isolate-action ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the controller and initiate incident response. Revoke any control-plane certificates associated with this instance and prepare for a re-image. ``` → forensic-task ## forensic-task ```manual target=analyst Retrieve the content of the modified scripts found in /etc/sv/. Verify if the host is vulnerable to CVE-2026-20127 by checking patch levels or hb_vulnerability_finding for the CVE ID. ``` → close-out-task ## close-out-task ```manual target=analyst Record the hosts examined and whether any evidence of service tampering was identified. Ensure tuning notes are added if legitimate maintenance caused noise. ``` → end