Stealthy Root-Level Account Creation

Elgonad .@elgonad

•updated Jan 28, 2026•0•41

Detects the creation of a local user account with root privileges (UID 0) using the 'useradd' command with the non-unique flag. This technique is used by threats like EncystPHP to create stealthy administrative accounts (e.g., 'newfpbx') for persistent access.