UAT-8616 troot Backdoor Account Creation on Cisco SD-WAN

Ethan Andrews@eandrews

•updated Jun 25, 2026•2•0•5

Detects the creation or manipulation of the 'troot' root-privileged backdoor account on Cisco Catalyst SD-WAN controllers, associated with the UAT-8616 exploit chain. The rule monitors for direct modification of /etc/passwd or /etc/shadow files, usage of useradd, grep operations on passwd files, and execution of su to the troot account.