Cisco Crosswork & Secure Workload Critical Flaws (5x CVSS 10.0): Detection, Hardening, and Remediation Guide

---
title: Suspicious Shell Spawned from Cisco Crosswork or Secure Workload Service Processes
id: 3f8c1a2e-7b4d-4e91-a6c2-9d5f0e8b7a31
status: experimental
description: Detects interactive shells or command interpreters spawned by web, API, or Java service processes on Cisco Crosswork or Secure Workload hosts — a hallmark of post-exploitation activity following RCE against the management plane.
references:
  - https://thehackernews.com/2026/08/cisco-patches-nine-crosswork-and-secure.html
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.execution
  - attack.t1059.004
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - 'java'
      - 'nginx'
      - 'apache'
      - 'tomcat'
      - 'node'
      - 'crosswork'
      - 'cndp'
      - 'tetration'
      - 'secureworkload'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/socat'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate automation scripts invoked by Cisco service daemons during upgrades or health checks — baseline during a known maintenance window
level: high
---
title: Credential or Configuration Store Access on Cisco Management Appliances
id: 91b2d4f6-3c8a-4e57-b2d9-1a6f7c0e5d42
status: experimental
description: Detects reads of credential, shadow, or application secret stores by non-system processes on Crosswork or Secure Workload hosts, consistent with post-compromise credential harvesting from the network controller.
references:
  - https://thehackernews.com/2026/08/cisco-patches-nine-crosswork-and-secure.html
  - https://attack.mitre.org/techniques/T1003/
  - https://attack.mitre.org/techniques/T1552/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.credential_access
  - attack.t1003
  - attack.t1552.001
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/etc/shadow'
      - '/etc/passwd'
      - '/etc/ssl/private'
      - 'keystore'
      - '.kube/config'
      - 'secrets.yaml'
      - 'credentials'
      - 'application-secret'
  filter_legit:
    Image|endswith:
      - '/sshd'
      - '/sudo'
      - '/login'
      - '/systemd'
      - '/kubelet'
  condition: selection and not filter_legit
falsepositives:
  - Backup agents and configuration management tools (Ansible, backup jobs) — restrict filter to approved automation service accounts
level: high
---
title: New Local Account Creation on Network Management Appliance
id: c47e9b1a-5d2f-4a83-8e6c-2b7d9f1a4e63
status: experimental
description: Detects user account creation via useradd/adduser or direct passwd modification on Cisco Crosswork or Secure Workload hosts — appliances where interactive account creation is rare and a strong persistence signal.
references:
  - https://thehackernews.com/2026/08/cisco-patches-nine-crosswork-and-secure.html
  - https://attack.mitre.org/techniques/T1136/001/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.persistence
  - attack.t1136.001
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/useradd'
      - '/adduser'
      - '/usermod'
      - '/chpasswd'
  filter_install:
    CommandLine|contains: '--system'
  condition: selection and not filter_install
falsepositives:
  - Initial appliance provisioning and OEM service account creation during software upgrades — correlate against change tickets and patch windows
level: high

// Hunt 1: Anomalous outbound connections from Crosswork / Secure Workload management hosts
let mgmt_hosts = dynamic ("crosswork", "cndg", "cwnc", "secureworkload", "tetration", "csw");
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceProduct has_any ("Cisco") or SourceHostName has_any (mgmt_hosts)
| where isnotempty(DestinationIP)
| extend IsPrivateDest = ipv4_is_private(DestinationIP)
| where IsPrivateDest == false
| summarize ConnCount = count(), Destinations = make_set(DestinationHostName, 20), Ports = make_set(DestinationPort, 20)
    by SourceHostName, DestinationIP, bin(TimeGenerated, 1h)
| order by ConnCount asc;

// Hunt 2: Suspicious HTTP request patterns against appliance management APIs (unauthenticated probing / exploitation attempts)
let mgmt_hosts2 = dynamic ("crosswork", "cndg", "cwnc", "secureworkload", "tetration", "csw");
Syslog
| where TimeGenerated > ago(7d)
| where HostName has_any (mgmt_hosts2)
| where SyslogMessage has_any ("/api/", "/crosswork/", "/app-ui/", "/oauth/", "/login", "/admin")
| where SyslogMessage has_any (" 401 ", " 403 ", " 500 ", " 404 ")
     or SyslogMessage has_any ("../", "%2e%2e", "cmd=", "exec=", "bash", "wget", "curl", "${")
| summarize Attempts = count(), SampleRequests = make_set(SyslogMessage, 10)
    by SourceIP = extract(@"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})", 0, SyslogMessage), HostName, bin(TimeGenerated, 1h)
| order by Attempts desc;

// Hunt 3: Process execution anomalies forwarded from management appliance syslog
Syslog
| where TimeGenerated > ago(7d)
| where HostName has_any ("crosswork", "cndg", "cwnc", "secureworkload", "tetration", "csw")
| where SyslogMessage has_any ("useradd", "adduser", "/bin/bash", "/bin/sh", "chmod +x", "crontab", "systemctl enable", "authorized_keys")
| project TimeGenerated, HostName, SeverityLevel, SyslogMessage
| order by TimeGenerated desc;

-- Hunt for post-exploitation artifacts on Cisco management-plane Linux hosts:
-- unexpected listeners, recently-modified persistence locations, and suspicious processes

-- Section 1: Processes with shells/interpreters spawned by service accounts
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (CommandLine =~ 'bash|/bin/sh|python|perl|nc |ncat|socat|wget|curl')
  AND Username =~ 'root|nobody|www|tomcat|crosswork|tetration'

-- Section 2: Listening sockets that do not match expected management services
SELECT Pid, Name, Laddr, Lport, Status
FROM netstat()
WHERE Status =~ 'LISTEN'
  AND NOT Lport IN (22, 80, 443, 8443, 161, 514, 6514, 30603)

-- Section 3: Recently modified persistence artifacts (last 7 days)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  '/etc/cron.d/*',
  '/var/spool/cron/*',
  '/home/*/.ssh/authorized_keys',
  '/root/.ssh/authorized_keys',
  '/etc/systemd/system/*.service',
  '/tmp/*',
  '/dev/shm/*'
])
WHERE Mtime > now() - (7 * 24 * 3600)
ORDER BY Mtime DESC

#!/bin/bash
# crosswork_secureworkload_verify.sh
# Verify exposure, versions, and hygiene of Cisco Crosswork / Secure Workload management planes
# Run from a management jump host with reachability to the appliance subnet(s).

set -euo pipefail
REPORT="cisco_mgmt_audit_$(date +%Y%m%d_%H%M%S).txt"
echo "=== Cisco Crosswork / Secure Workload Exposure & Hygiene Audit ===" | tee "$REPORT"

# 1) Define your appliance inventory (edit to match your environment)
APPLIANCES=("crosswork-nc.example.com" "crosswork-dgw.example.com" "crosswork-plan.example.com" "secureworkload.example.com")
MGMT_PORTS=(443 8443 30603 22)

# 2) Check management-plane reachability and TLS posture per appliance
echo -e "\n--- [1] Management Interface Reachability & TLS ---" | tee -a "$REPORT"
for host in "${APPLIANCES[@]}"; do
  for port in "${MGMT_PORTS[@]}"; do
    if timeout 5 bash -c "</dev/tcp/$host/$port" 2>/dev/null; then
      echo "[OPEN] $host:$port" | tee -a "$REPORT"
      if [ "$port" == "443" ] || [ "$port" == "8443" ]; then
        echo | timeout 8 openssl s_client -connect "$host:$port" -servername "$host" 2>/dev/null \
          | openssl x509 -noout -issuer -subject -dates 2>/dev/null | tee -a "$REPORT" || true
      fi
    else
      echo "[CLOSED/FILTERED] $host:$port" | tee -a "$REPORT"
    fi
  done
done

# 3) Flag exposure: management interfaces should NEVER resolve/route from untrusted networks.
#    From an external vantage (separate run), repeat section 2 — ANY open result = critical finding.
echo -e "\n--- [2] External Exposure Check ---" | tee -a "$REPORT"
echo "ACTION REQUIRED: Re-run this script from an untrusted network (or use an external scanner)." | tee -a "$REPORT"
echo "Any [OPEN] result on 443/8443/30603/22 from outside your mgmt VRF is a P1 finding." | tee -a "$REPORT"

# 4) Version verification — pull installed software version from the appliance CLI/API.
#    Crosswork: SSH to the appliance and run 'show version' / check the UI System > Summary.
#    Compare against the Fixed Software table in the Cisco Security Advisory.
echo -e "\n--- [3] Version Check (manual confirmation required) ---" | tee -a "$REPORT"
for host in "${APPLIANCES[@]}"; do
  echo "-> SSH to $host and capture: show version (Crosswork) / System Info (Secure Workload UI)" | tee -a "$REPORT"
  echo "   Compare against Fixed Software releases: https://sec.cloudapps.cisco.com/security/center/publicationListing.x" | tee -a "$REPORT"
done

# 5) Audit local accounts and recent changes on supporting Linux infrastructure
echo -e "\n--- [4] Local Account & Persistence Audit (supporting Linux hosts) ---" | tee -a "$REPORT"
if [ -f /etc/passwd ]; then
  echo "Accounts with interactive shells (UID >= 1000 or root):" | tee -a "$REPORT"
  awk -F: '($3 >= 1000 || $3 == 0) && $7 ~ /(bash|sh|zsh)$/ {print $1" (uid "$3")"}' /etc/passwd | tee -a "$REPORT"
  echo "Recently modified cron/systemd artifacts (7 days):" | tee -a "$REPORT"
  find /etc/cron.d /var/spool/cron /etc/systemd/system -type f -mtime -7 2>/dev/null | tee -a "$REPORT" || true
fi

echo -e "\nAudit complete. Report: $REPORT"