User Has Been Deleted Via Userdel

Title: User Has Been Deleted Via Userdel
Status: test
Description:Detects execution of the "userdel" binary. Which is used to delete a user account and related files. This is sometimes abused by threat actors in order to cover their tracks
References:
  -https://linuxize.com/post/how-to-delete-group-in-linux/
  -https://www.cyberciti.biz/faq/linux-remove-user-command/
  -https://www.cybrary.it/blog/0p3n/linux-commands-used-attackers/
  -https://linux.die.net/man/8/userdel
Author: Tuan Le (NCSGroup)
Date: 2022-12-26
modified:None
Tags:

• -'attack.impact'
• -'attack.t1531'

Logsource:

• product: linux
• category: process_creation

Detection:
  selection:
    Image|endswith: '/userdel'
  condition:selection
Falsepositives:
  -Legitimate administrator activities
Level: medium