Splunk unknown stable spl

Linux Auditd Add User Account

The following analytic detects the creation of new user accounts on Linux systems using commands like "useradd" or "adduser." It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as adversaries often create new user accounts to establish persistence on compromised hosts. If confirmed malicious, this could allow attackers to maintain access, escalate privileges, and further compromise the system, posing a severe security risk.

View Source

Detection Logic

`linux_auditd` proctitle IN ("*useradd*", "*adduser*")
| rename host as dest
| stats count min(_time) as firstTime max(_time) as lastTime
    BY proctitle dest
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_auditd_add_user_account_filter`

False Positives

  • ⚠ Administrator or network operator can execute this command. Please update the filter macros to remove false positives.

Field Validations

Loading…

Comments (0)

Loading comments...