RouterOS login using literal username '-2' (CVE-2026-86060 privilege escalation)
Detects evidence of an argument-injection attack against MikroTik RouterOS (CVE-2026-86060), where the attacker provides the literal username '-2' during the login process. This action allows the attacker to bypass standard credential validation by exploiting a forged privilege mask. This is typically observed in conjunction with unauthorized access attempts following CVE-2026-67279.
Microsoft Sentinel (KQL)
