Detection of New User Account Creation on Linux

Adversaries often create new user accounts to establish persistence after compromising a Linux host. This activity allows attackers to maintain long-term access, escalate privileges, and bypass existing security controls that might be tied to specific user sessions. This detection identifies the execution of user account creation utilities, specifically "useradd" and "adduser," by leveraging Linux Auditd "proctitle" logs. The ability to track the creation of local accounts is vital for defenders to identify unauthorized administrative actions that may indicate a breach. This analytic is designed for security operations teams using EDR or host-based audit logging to monitor for anomalous account creation events.

Impact

Successful account creation by an unauthorized actor provides a stable, persistent foothold on a system. This can lead to lateral movement, data exfiltration, and long-term control over the compromised host. If left undetected, attackers can leverage these accounts to perform further system reconnaissance and facilitate additional malicious activities without relying solely on the original initial access vector.

Recommendation

• Ingest Auditd SYSCALL, EXECVE, and PROCTITLE events using the Splunk Add-on for Unix and Linux.
• Normalize ingested logs to match the Common Information Model (CIM) to ensure consistency and improve detection efficacy.
• Deploy the Sigma rule provided in this brief to detect the execution of "useradd" or "adduser" utilities.
• Update filter macros within your SIEM to exclude known legitimate administrative activity or automated provisioning scripts to reduce false positives.