UAT-8616 troot account creation on Cisco SD-WAN controllers

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects suspicious user account creation activity or direct modification of the /etc/passwd file. The rule flags the use of 'useradd' or 'adduser' commands, as well as unauthorized attempts to inject root users into the passwd file, specifically looking for indicators like 'troot' (a common misconfiguration or backdoor username pattern).