Backdoor xadmin account inserted into Nacos DB via bcrypt-hashed SQL and rapid retry

Duo Tech@duotech

•updated Jul 8, 2026•4•0•30

This rule detects potentially unauthorized database manipulation of the 'xadmin' platform, including suspicious administrative role modifications and deletions. It also monitors for suspicious Python script execution involving the 'bcrypt' library, which can be used to generate or verify password hashes in potentially malicious scripts.