Your IDS discovers that an intruder has gained access to your system. You immediately stop that access, change passwords for administrative accounts, and secure your network. You discover an odd…

IP spoofing involves forging the source IP address in network packets to disguise the attacker's origin - it does not involve creating user accounts or altering system access controls.

Attackers commonly create hidden or inconspicuous accounts with remote access privileges as a backdoor to maintain persistent access after an intrusion is detected and initial attack vectors are closed. The account's remote access permission is the key indicator because it allows the attacker to re-enter from outside the network even after password changes and firewall updates are applied.

While large networks do have many accounts, an unknown account with remote access permissions discovered in direct temporal context with a confirmed intrusion is strong evidence of malicious account creation, not an administrative oversight.

Privilege escalation refers to an attacker gaining elevated permissions from an already-compromised account - this scenario describes the creation of a new account for persistent re-entry, which is persistence, not privilege escalation.