Detect Cisco Catalyst SD-WAN Controller Authentication Bypass (CVE-2026-20182) in Google Chronicle

rule cisco_sdwan_auth_bypass_cve_2026_20182 {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects authentication bypass exploitation of CVE-2026-20182 in Cisco Catalyst SD-WAN Controller"
    severity = "CRITICAL"
    priority = "HIGH"
    cve = "CVE-2026-20182"
    mitre_attack = "T1190, T1078, T1556"
    created = "2026-06-19"

  events:
    (
      $e1.metadata.event_type = "NETWORK_HTTP" or
      $e1.metadata.event_type = "NETWORK_CONNECTION" or
      $e1.metadata.event_type = "USER_LOGIN"
    )
    and (
      $e1.target.application = /(?i)(vmanage|vsmart|vbond|sd.wan|catalyst.sdwan)/ or
      $e1.target.port = 8443 or
      $e1.target.port = 830 or
      (
        $e1.target.port = 443 and
        (
          $e1.network.http.referral_url = /(?i)\/dataservice/ or
          $e1.network.http.referral_url = /(?i)\/j_security_check/
        )
      )
    )
    and (
      $e1.network.http.response_code = 200 or
      $e1.network.http.response_code = 302
    )
    and not net.ip_in_range_cidr($e1.principal.ip, "10.0.0.0/8")
    and not net.ip_in_range_cidr($e1.principal.ip, "172.16.0.0/12")
    and not net.ip_in_range_cidr($e1.principal.ip, "192.168.0.0/16")

  match:
    $e1.principal.ip over 5m

  outcome:
    $risk_score = max(
      if($e1.target.port = 830, 95,
      if($e1.target.port = 8443, 90, 80))
    )
    $event_count = count_distinct($e1.metadata.id)
    $target_ips = array_distinct($e1.target.ip)
    $source_ip = $e1.principal.ip

  condition:
    #e1 > 3
}