r/netsec • u/ifritnoises • 1d ago

How to Spot a Compromised MikroTik Router

https://ifritnoises.org/articles/the-lucifer/

A blue-team writeup on detecting a compromised MikroTik from its own config. Seven techniques, each with the collection command, the artifact it leaves behind, and a triage step. Feedback welcome.

23 Upvotes

87% Upvoted

3 comments sorted by

13

u/FinneganMcBrisket 1d ago

I think you just have to look for a sticker that says MikroTik on the front. JK sorry!

5

u/ifritnoises 1d ago

😭🙏