UAT-8616 troot Backdoor Account Creation on Cisco SD-WAN Controller

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•3

Detects process command lines containing references to sensitive Unix system files (/etc/passwd or /etc/shadow) specifically when accessed within or in association with a /troot/ directory path. This pattern is often indicative of an adversary performing reconnaissance or credential dumping.