Unauthorized root-level modification of Acronis backup files

Ibrahim Saud@tektrix

•updated Sep 16, 2026•1•0•3

Detects instances where a process running as 'root' modifies files within an Acronis-related directory. This specifically alerts when the modifying process is not identified as a known, authorized Acronis backup service, potentially indicating unauthorized tampering with backup archives or configuration files.