--- analysis: This hunt uses a gated logic to justify deep behavioral analysis of ptrace syscalls and memory-resident modules that are too noisy for continuous rules but effectively reveal stealthy in-memory implants. blind_spots: - id: missing-file-telemetry question: whether staging files like vdaemon.conf existed but were deleted before collection requires: hb_file_activity coverage for /var/tmp and /tmp risk: KeyDrift deletes its configuration file immediately after reading, making it a transient lead. stage: exfiltration-in-band-c2 - id: missing-audit-telemetry question: whether injection occurred on hosts where syscall auditing is disabled requires: hb_linux_audit with ptrace syscall logging risk: If ptrace auditing is not enabled, the mechanism of injection is invisible, and the hunt relies solely on memory-map snapshots. stage: execution-injection-ptrace coverage: - stage: execution-injection-ptrace status: covered steps: - rare-ptrace-activity - stage: collection-in-process-hooking status: covered steps: - rare-vdaemon-modules - reason: Covered through detection of the encrypted staging telemetry file /var/tmp/vdaemon.bin. stage: exfiltration-in-band-c2 status: covered steps: - lead-file-indicators - reason: 'Belongs to another part of the ''Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN'' series.' stage: initial-access-cisco-auth-bypass status: out_of_scope - reason: 'Belongs to another part of the ''Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN'' series.' stage: persistence-runit-service-tampering status: out_of_scope - reason: 'Belongs to another part of the ''Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN'' series.' stage: defense-evasion-remount-rootfs status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: The UAT-11473 KeyDrift framework allows persistent administrative-level access and automated exfiltration of SD-WAN control-plane keying material, which can compromise the entire network fabric. methodology: model-assisted trigger: intel-report hypothesis: An adversary is using ptrace to inject malicious modules into the vdaemon process on a Cisco SD-WAN controller to intercept and exfiltrate control-plane keying material. labels: - hunt - attack.t1055.008 - attack.t1574.006 - attack.t1059.004 - attack.t1036.004 - attack.t1041 - collection - defense evasion - execution - exfiltration - initial access - persistence name: KeyDrift Framework Runtime Injection and Hooking parameters: indicator_files: default: - /tmp/system-vdaemon - /var/tmp/vdaemon.bin - /var/tmp/vdaemon.conf description: KeyDrift staging and configuration files observed in Talos research. from: kind: article observed: '2026-10-28' ref: https://blog.talosintelligence.com/uat-11473-keydrift/ type: list[path] lookback_days: default: '14' description: Days of history to examine for staging and injection behavior. from: kind: manual observed: '2026-10-28' ref: standard-lookback type: number scope_hosts: default: [] description: List of hostnames to scope the hunt to; empty means the whole estate. from: kind: manual observed: '2026-10-28' ref: analyst-scope type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://blog.talosintelligence.com/uat-11473-keydrift/ gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Scope this hunt to Cisco Catalyst SD-WAN Controller roles, specifically vSmart, vManage, and vBond instances where the vdaemon process resides. Start with controllers exposed to the internet. references: - name: "Cisco Talos \u2014 Inside KeyDrift: Analyzing historical UAT-11473 activity\ \ on Cisco SD-WAN" url: https://blog.talosintelligence.com/uat-11473-keydrift/ related: - hunt: keydrift-persistence-runit reason: The modification of runit service scripts for persistence on disk is handled by a separate hunt in this series. relation: out-of-scope-alternative - hunt: cisco-sd-wan-service-tampering relation: follows scenario: stages: - name: Cisco SD-WAN Authentication Bypass observables: - CVE-2026-20127 - Cisco SD-WAN Catalyst Controller slug: initial-access-cisco-auth-bypass tactic: initial-access techniques: - T1190 - name: Runit Service Launcher Modification observables: - /etc/sv/sshd/run - /etc/sv/aaamgr/run - deletion of writable-overlay PAM configurations - invocation of malicious run scripts before legitimate service start slug: persistence-runit-service-tampering tactic: persistence techniques: - T1037 - T1543 - name: Rootfs Executable Remounting observables: - remount /rootfs.rw as executable - mount -o remount,exec /rootfs.rw slug: defense-evasion-remount-rootfs tactic: defense-evasion techniques: - T1574.006 - name: Process Injection and PID Enumeration observables: - conf_sshd script execution - rsshd injector execution - aaamgrd packed loader execution - ptrace system calls against vdaemon processes - /tmp/system-vdaemon - enumeration of vdaemon PIDs slug: execution-injection-ptrace tactic: execution techniques: - T1055.008 - T1059.004 - T1036.004 - name: Control-Plane Interception Hooking observables: - libdssl.so (PolyFlame) - libcommon.so (LittleFilch) - hooking of SSL_read inside vdaemon - hooking of recvfrom, sendto, and dlopen in vdaemon - interposition of runtime-linker behavior slug: collection-in-process-hooking tactic: collection techniques: - T1574.006 - name: Telemetry Staging and C2 Exfiltration observables: - /var/tmp/vdaemon.bin (RSA-encrypted telemetry) - /var/tmp/vdaemon.conf (Endpoint configuration) - UDP exfiltration in DTLS 1.2 style records - TinyShell command codes 0x100, 0x200, 0x300 slug: exfiltration-in-band-c2 tactic: exfiltration techniques: - T1041 summary: UAT-11473 exploited an authentication bypass vulnerability (CVE-2026-20127) in Cisco SD-WAN Catalyst Controllers to gain unauthorized administrative access. The threat actor established persistence by modifying runit service scripts to launch the KeyDrift framework, which uses ptrace injection and runtime hooking to intercept sensitive control-plane keying material and exfiltrate it over UDP. series: index: 2 slug: inside-keydrift-analyzing-historical-uat-11473-activity-on-cisco-sd-wan title: 'Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN' total: 2 severity: critical targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent tlp: clear type: investigation --- # KeyDrift Framework Runtime Injection and Hooking This hunt targets the runtime behavior of the UAT-11473 KeyDrift framework. It begins with a lead query for high-fidelity staging files in /tmp and /var/tmp that indicate an active intrusion. If found, the hunt triggers a deep dive into Linux audit logs using prevalence to detect rare processes invoking ptrace and examines vdaemon process memory maps for rare shared objects. An agent correlates these behavioral signals to confirm that an adversary has established in-process collection of SD-WAN control traffic. ## lead-file-indicators Identify hosts where KeyDrift staging files or telemetry records exist in common temporary directories. ```sqlite target=endpoint role=triage params=(indicator_files=indicator_files, lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: Rows indicating the presence of /var/tmp/vdaemon.bin or /tmp/system-vdaemon. Silence suggests no such staging files were logged in the window. reads: - device_hostname - file_path - process_name - time silence: not_evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-10-29' ~~~ SELECT device_hostname, file_path, process_name, time FROM hb_file_activity WHERE instr(',' || '{{indicator_files}}' || ',', ',' || LOWER(file_path) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## assess-lead ```agent target=hunter cite: required context: - lead-file-indicators max_iterations: 3 objective: Decide if the file activity observed on any host matches the KeyDrift framework staging behavior described in the article. success_criteria: A malicious or suspicious verdict for any host where KeyDrift staging indicators were identified. tools: - endpoint ``` ## gate-decision if~: "the assess-lead verdict is malicious or suspicious for at least one host" (confidence: high, judge=hunter) then: → deep-investigation indeterminate: → analyst-review unavailable: → analyst-review (blind_spot: missing-file-telemetry) else: → close-out ## deep-investigation parallel: - → rare-ptrace-activity - → rare-vdaemon-modules join: → final-triage ## rare-ptrace-activity Search for ptrace syscalls invoked by rare processes, which is the primary mechanism of PolyFlame injection into vdaemon. ```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Rare processes using ptrace. Legitimate diagnostic tools or debuggers are usually common across the fleet; injectors like rsshd will appear on few hosts. prevalence: by: device_hostname key: - process_name rare_below: 3 reads: - device_hostname - process_name - syscall - time silence: not_evidence_of_absence source: hb_linux_audit verified: dry-run verified_at: '2026-10-29' ~~~ SELECT process_name, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_linux_audit WHERE syscall = 'ptrace' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_name HAVING hosts < 3 ``` ## rare-vdaemon-modules Identify any rare shared objects loaded into the vdaemon process across the fleet to find the PolyFlame and LittleFilch modules. ```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Modules loaded into vdaemon on only one or two hosts. These indicate potential injected implants like libdssl.so or libcommon.so. prevalence: by: device_hostname key: - module_path rare_below: 3 reads: - device_hostname - module_path - process_name - time silence: evidence_of_absence source: hb_module_activity verified: dry-run verified_at: '2026-10-29' ~~~ SELECT module_path, process_name, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_module_activity WHERE LOWER(process_name) LIKE '%vdaemon%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY module_path, process_name HAVING hosts < 3 ``` ## final-triage ```agent target=hunter cite: required context: - lead-file-indicators - assess-lead - rare-ptrace-activity - rare-vdaemon-modules max_iterations: 6 objective: Determine if the collective evidence from all queries confirms that the KeyDrift framework is active and intercepting traffic on the host. success_criteria: A final assessment that identifies the host, the injector process, and the malicious shared objects found in memory. tools: - endpoint ``` ## route-to-action if~: "the final-triage verdict is malicious for at least one host" (confidence: high, judge=hunter) then: → isolate-host indeterminate: → analyst-review unavailable: → analyst-review (blind_spot: missing-audit-telemetry) else: → close-out ## isolate-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the endpoint. Capture a memory dump and disk image before any remediation, as PolyFlame is primarily memory-resident. ``` → analyst-review ## analyst-review ```manual target=analyst Review the cited ptrace activity and module loading. If vdaemon.bin was identified, attempt to recover the RSA-encrypted records for analysis of extracted keying material. ``` → close-out ## close-out ```manual target=analyst Record what was examined and what was not visible. If no indicators were found, document the negative result as evidence of security for the controller estate. ``` → end