root intrusion documentation