Local System Accounts Discovery - Linux

Title: Local System Accounts Discovery - Linux
Status: test
Description:Detects enumeration of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.001/T1087.001.md
  -https://my.f5.com/manage/s/article/K589
  -https://man.freebsd.org/cgi/man.cgi?pwd_mkdb
Author: Alejandro Ortuno, oscd.community, CheraghiMilad
Date: 2020-10-08
modified:2024-12-10
Tags:

• -'attack.discovery'
• -'attack.t1087.001'

Logsource:

• category: process_creation
• product: linux

Detection:
  selection_1:
    Image|endswith: '/lastlog'
  selection_2:
    CommandLine|contains: ''x:0:''
  selection_3:
    Image|endswith:
      -'/cat'
      -'/ed'
      -'/head'
      -'/more'
      -'/nano'
      -'/tail'
      -'/vi'
      -'/vim'
      -'/less'
      -'/emacs'
      -'/sqlite3'
      -'/makemap'

    CommandLine|contains:
      -'/etc/passwd'
      -'/etc/shadow'
      -'/etc/sudoers'
      -'/etc/spwd.db'
      -'/etc/pwd.db'
      -'/etc/master.passwd'

  selection_4:
    Image|endswith: '/id'
  selection_5:
    Image|endswith: '/lsof'
    CommandLine|contains: '-u'
  condition:1 of selection*
Falsepositives:
  -Legitimate administration activities
Level: low