#truebot

Analysis · May 20, 2026 · Colten Anderson

The tool that audits everything runs as SYSTEM everywhere. That cuts both ways.

CVE-2022-31199 is unauthenticated RCE as SYSTEM in Netwrix Auditor, and it hits the server and the agents on every monitored system. Truebot used it. A privileged monitoring tool with agents across your estate is a shadow administration layer, and a force multiplier when it's compromised.