Linux auditd: New user account creation via useradd syscall or ADD_USER audit event

title: "Linux auditd: New user account creation via useradd syscall or ADD_USER audit event"
id: d63e3ac1-2ff4-43f7-894f-3d7cb144bb43
status: test
description: This rule identifies creation of a new local user account by matching Linux auditd events associated with the useradd command, specifically either SYSCALL records where the executable ends with /useradd or ADD_USER audit records. Attackers may add accounts to establish persistence without needing remote access tooling to be installed. Detection relies on auditd telemetry capturing SYSCALL and ADD_USER event types from user management activity.
references:
  - https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-understanding_audit_log_files
  - https://access.redhat.com/articles/4409591#audit-record-types-2
  - https://www.youtube.com/watch?v=VmvY5SQm5-Y&ab_channel=M45C07
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/syscall/lnx_auditd_create_account.yml
author: Marie Euler, Pawel Mazur, Huntrule Team
date: 2020-05-18
modified: 2022-12-20
tags:
  - attack.t1136.001
  - attack.persistence
logsource:
  product: linux
  service: auditd
detection:
  selection_syscall_record_type:
    type: SYSCALL
    exe|endswith: /useradd
  selection_add_user_record_type:
    type: ADD_USER
  condition: 1 of selection_*
falsepositives:
  - Admin activity
level: medium
license: DRL-1.1
related:
  - id: 759d0d51-bc99-4b5e-9add-8f5b2c8e7512
    type: derived