MikroTik RouterOS unauthorized 'ops' admin account creation

Ibrahim Saud@tektrix

•updated Sep 24, 2026•0•0•6

Detects the creation of a new local user account named 'ops' or an account with 'full' group privileges on MikroTik RouterOS. This rule is designed to identify potential persistence mechanisms following the exploitation of MikroTrick vulnerabilities (CVE-2026-67279/CVE-2026-86060), often indicated by anomalous prior login patterns.