This note documents detection patterns related to New User Creation on Linux systems.

Direct Indicators

Indirect Indicators

Common Tools

Relevant Artifacts

MITRE ATT&CK References

• T1136 Create Account
• T1136.001 Local Account
• T1098 Account Manipulation
• T1098.004 SSH Authorized Keys
• T1548 Abuse Elevation Control Mechanism

Decision Tree

1. Is a suspicious local account present?

   • Inspect /etc/passwd, /etc/shadow, /etc/group.
   • Determine username, UID, shell, home directory, group membership.

2. Is the account actually new or merely newly noticed?

   • Compare against host baseline, golden image, deployment scripts, backup copies, config management, or previous snapshots.
   • Check file timestamps on /etc/passwd, /etc/shadow, /etc/group.

3. How was the account created?

   • Search auth.log / secure / journalctl for useradd, adduser, usermod, passwd, sudo.
   • Search shell history for account management commands.
   • Review auditd for execve if available.

4. Was privilege granted?

   • Inspect membership in sudo, wheel, docker, lxd, adm.
   • Inspect /etc/sudoers and /etc/sudoers.d/.
   • Determine whether shell is interactive and whether account can escalate.

5. Was the account used?

   • Review last, lastlog, SSH login logs, authorized_keys, bash history.
   • Check whether the account established persistence, downloaded payloads, or opened network connections.

6. Pivot

   • Source logon event → identify actor/session that created the account.
   • New home directory → inspect commands, keys, tools, payloads.
   • Group changes → determine escalation objective.
   • Related SSH artifacts → determine remote persistence plan.

7. Confirm maliciousness

   • Unknown account + no legitimate provisioning trail + privileged group membership + SSH key or sudo access = strong malicious persistence finding.

Example Detection Templates

Grep

grep -Ei "useradd|adduser|usermod|groupadd|passwd|new user" /var/log/auth.log /var/log/secure 2>/dev/null

grep -Ei "COMMAND=/usr/sbin/(useradd|adduser|usermod)|COMMAND=/usr/bin/passwd" /var/log/auth.log /var/log/secure 2>/dev/null

grep -E '^(sudo|wheel|adm|docker|lxd):' /etc/group

awk -F: '($3 >= 1000 || $3 == 0) {print $1,$3,$6,$7}' /etc/passwd

find /home -maxdepth 1 -mindepth 1 -type d -printf '%TY-%Tm-%Td %TT %u %g %p\n' 2>/dev/null | sort

Journalctl

journalctl | grep -Ei "useradd|adduser|usermod|groupadd|passwd|sudo"

journalctl _COMM=sudo | grep -Ei "useradd|adduser|usermod|passwd"

Auditd

ausearch -m EXECVE -i | grep -Ei "useradd|adduser|usermod|passwd"

ausearch -m USER_CHAUTHTOK,ADD_USER,DEL_USER,ADD_GROUP,DEL_GROUP -i

Sigma

title: Linux Local User Creation or Account Privilege Manipulation
id: linux-local-user-creation-or-modification
status: experimental
description: Detects account creation or modification activity on Linux systems that may indicate attacker persistence
logsource:
  product: linux
  service: auth
detection:
  selection_keywords:
    message|contains:
      - 'useradd'
      - 'adduser'
      - 'usermod'
      - 'new user'
      - 'groupadd'
  condition: selection_keywords
fields:
  - message
  - hostname
  - process
  - user
falsepositives:
  - Legitimate administrator provisioning
  - Configuration management
  - Cloud-init or image bootstrap processes
level: high
tags:
  - attack.persistence
  - attack.t1136
  - attack.t1136.001
  - attack.t1098

Mitigation & Hardening