Detects attempts to enable the root account via "dsenableroot"
Read the full analysis on IntelFusions