Backdoor xadmin account creation via SQL injection into Nacos DB

Duo Tech@duotech

•updated Jul 8, 2026•2•0•2

Detects rapid, suspicious command-line activity indicative of unauthorized user account creation or modification within a database environment, specifically targeting 'xadmin' or 'ROLE_ADMIN' roles accompanied by password hashing commands. The rule monitors for multiple events within a 120-second window to identify potentially automated or batch unauthorized account provisioning.