Suspicious Creation Of An User Account (via auditd)

title: Suspicious Creation Of An User Account (via auditd)
id: c4d70f39-9c27-5df1-bb2d-838b309bad4a
status: stable
description: This rule detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.
references:
    - https://attack.mitre.org/techniques/T1136/001/
    - https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-understanding_audit_log_files
    - https://access.redhat.com/articles/4409591#audit-record-types-2
    - https://www.youtube.com/watch?v=VmvY5SQm5-Y&ab_channel=M45C07
author: Huntrule Team
date: 2026-05-24
tags:
    - attack.t1136.001
    - attack.persistence
logsource:
    product: linux
    service: auditd
detection:
    selection_syscall_record_type:
        type: 'SYSCALL'
        exe|endswith: '/useradd'
    selection_add_user_record_type:
        type: 'ADD_USER'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: medium