Creation Of An User Account

Title: Creation Of An User Account
Status: test
Description:Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.
References:
  -https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-understanding_audit_log_files
  -https://access.redhat.com/articles/4409591#audit-record-types-2
  -https://www.youtube.com/watch?v=VmvY5SQm5-Y&ab_channel=M45C07
Author: Marie Euler, Pawel Mazur
Date: 2020-05-18
modified:2022-12-20
Tags:

• -'attack.t1136.001'
• -'attack.persistence'

Logsource:

• product: linux
• service: auditd

Detection:
  selection_syscall_record_type:
    type: 'SYSCALL'
    exe|endswith: '/useradd'
  selection_add_user_record_type:
    type: 'ADD_USER'
  condition:1 of selection_*
Falsepositives:
  -Admin activity
Level: medium