Linux Local Account Discovery via System Account and Password File Viewing

title: Linux Local Account Discovery via System Account and Password File Viewing
id: 519a106e-7363-4575-a973-694ac9f37220
status: test
description: This rule identifies process executions associated with enumerating local system accounts by reading common account and password-related files or using account-lookup utilities. Attackers rely on this discovery to learn which local users exist and to tailor follow-on access attempts. Telemetry required is process creation data including the executed binary path and its command-line arguments (e.g., invocations of tools accessing files under /etc and utilities like lastlog, id, and lsof).
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.001/T1087.001.md
  - https://my.f5.com/manage/s/article/K589
  - https://man.freebsd.org/cgi/man.cgi?pwd_mkdb
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_local_account.yml
author: Alejandro Ortuno, oscd.community, CheraghiMilad, Huntrule Team
date: 2020-10-08
modified: 2024-12-10
tags:
  - attack.discovery
  - attack.t1087.001
logsource:
  category: process_creation
  product: linux
detection:
  selection_1:
    Image|endswith: /lastlog
  selection_2:
    CommandLine|contains: "'x:0:'"
  selection_3:
    Image|endswith:
      - /cat
      - /ed
      - /head
      - /more
      - /nano
      - /tail
      - /vi
      - /vim
      - /less
      - /emacs
      - /sqlite3
      - /makemap
    CommandLine|contains:
      - /etc/passwd
      - /etc/shadow
      - /etc/sudoers
      - /etc/spwd.db
      - /etc/pwd.db
      - /etc/master.passwd
  selection_4:
    Image|endswith: /id
  selection_5:
    Image|endswith: /lsof
    CommandLine|contains: -u
  condition: 1 of selection*
falsepositives:
  - Legitimate administration activities
level: low
license: DRL-1.1
related:
  - id: b45e3d6f-42c6-47d8-a478-df6bd6cf534c
    type: derived