Which SIEM platforms have a CVE-2022-20775 detection rule?

df00tech provides CVE-2022-20775 (CVE-2022-20775 — Cisco SD-WAN Path Traversal Exploitation Attempt) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the CVE-2022-20775 detection?

The CVE-2022-20775 detection is rated critical severity with medium confidence.

What are common false positives for CVE-2022-20775?

Common false positives for CVE-2022-20775 include: Legitimate administrative scripts that access SD-WAN APIs using encoded path characters for valid configuration management; Automated backup or compliance tooling that reads system files while running under SD-WAN service accounts; Security scanners or vulnerability assessment tools performing authorized testing of SD-WAN infrastructure.

CVE-2022-20775 IBM QRadar · QRadar

Detect CVE-2022-20775 — Cisco SD-WAN Path Traversal Exploitation Attempt in IBM QRadar

Q: What data sources are required to detect CVE-2022-20775 — Cisco SD-WAN Path Traversal Exploitation Attempt (CVE-2022-20775)?

Detecting CVE-2022-20775 — Cisco SD-WAN Path Traversal Exploitation Attempt requires the following data sources: Microsoft Defender for Endpoint, Microsoft Sentinel Network Logs, Azure Monitor.

Detects exploitation attempts targeting CVE-2022-20775, a path traversal vulnerability (CWE-25, CWE-282) in Cisco SD-WAN software. Successful exploitation may allow an authenticated attacker to read or write arbitrary files on the underlying operating system, potentially leading to privilege escalation or persistent access. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog.

MITRE ATT&CK

Tactic: Initial Access Privilege Escalation Defense Evasion

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  URL,
  "Process Name",
  username,
  logsourcename(logsourceid) AS log_source,
  QIDNAME(qid) AS event_name
FROM events
WHERE
  (
    (
      (URL ILIKE '%../%' OR URL ILIKE '%..\\%' OR URL ILIKE '%2e%2e%2f%' OR URL ILIKE '%252e%252e%' OR URL ILIKE '%..%2f%')
      AND (URL ILIKE '%/dataservice/%' OR URL ILIKE '%/template/%' OR URL ILIKE '%/device/%' OR URL ILIKE '%/vmanage%')
    )
    OR
    (
      "Process Name" ILIKE '%vdaemon%' OR "Process Name" ILIKE '%vmanage%' OR "Process Name" ILIKE '%vbond%'
      AND "Command Line" MATCHES '.*\b(bash|sh|python|curl|wget|nc)\b.*'
    )
  )
  AND LOGSOURCETYPENAME(devicetype) IN ('Cisco SD-WAN', 'Linux OS', 'Apache HTTP Server')
LAST 7 DAYS

critical severity medium confidence

Queries QRadar for path traversal sequences in URL fields from SD-WAN log sources and suspicious subprocess execution patterns linked to SD-WAN daemon processes.

Data Sources

Cisco SD-WANLinux SyslogNetwork IDS

Required Tables

events

False Positives & Tuning

URL encoding variations used by legitimate REST API clients interacting with vManage
Authorized red team operations targeting SD-WAN infrastructure
Backup and restore procedures that temporarily invoke shell commands under vdaemon context

Other platforms for CVE-2022-20775

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Cisco SD-WAN vManage Path Traversal File Read via API
Expected signal: HTTP request log entry with traversal sequence in URI; if successful, HTTP 200 response with /etc/passwd content; file access audit event for /etc/passwd by vManage process
Test 2Cisco SD-WAN Percent-Encoded Path Traversal Bypass
Expected signal: HTTP access log entry with double-encoded sequence; IDS/WAF alert if deployed; server-side decode of %25 sequences visible in application logs
Test 3SD-WAN Post-Exploitation SSH Key Injection via Traversal Write
Expected signal: HTTP POST to path traversal URI; file modification event on /root/.ssh/authorized_keys; audit log entry showing vManage process writing to /root/.ssh/
Test 4Simulate SD-WAN Daemon Spawning Reverse Shell
Expected signal: Process creation event: parent=vmanage, child=bash with -i flag and TCP redirect in command line; network connection from bash process to 127.0.0.1:4444; EDR alert on shell spawned by non-interactive parent

Last updated: 2026-06-19 Research depth: standard

References (4)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for CVE-2022-20775 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Related Detections

Tactic Hubs

TA0001Initial Access TA0004Privilege Escalation TA0005Defense Evasion

Related Techniques

T1190Exploit Public-Facing Application T1548Abuse Elevation Control Mechanism T1083File and Directory Discovery T1552.004Private Keys

Detect CVE-2022-20775 — Cisco SD-WAN Path Traversal Exploitation Attempt in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for CVE-2022-20775

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Initial Access

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for CVE-2022-20775

Testing Methodology

Unlock Pro Content

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Initial Access

Popular Detections

Get new detections in your inbox