UAT-8616 troot Backdoor Account Creation on Cisco SD-WAN

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

This rule detects potentially malicious activities on Linux systems involving the creation of new accounts or access to sensitive files like /etc/passwd and /etc/shadow using or referencing the string 'troot'. This pattern is often associated with adversary attempts to create backdoored accounts or perform offline password cracking by manipulating or dumping authentication files.