Cisco SD-WAN SSH Authorized Key Implantation and troot Account Creation

Ibrahim Saud@tektrix

•updated Jun 25, 2026•2•0•18

This rule detects suspicious activity on Linux systems including unauthorized modification of SSH authorized_keys, creation of unauthorized system accounts (e.g., 'troot'), manipulation of critical system files like /etc/passwd or /etc/shadow, and the execution of specific suspicious scripts or commands indicative of an exploit or post-exploitation activity.