Sigma rule: Creation Of An User Account
A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-2918407c2b49, updated 2022-12-20T00:00:00.000Z.
Rule
- Title
- Creation Of An User Account
- Status
- test
- Level
- medium
- Author
- Marie Euler, Pawel Mazur
- Date
- 2020-05-18
- Modified
- 2022-12-20
- File
- rules/linux/auditd/syscall/lnx_auditd_create_account.yml
- Commit
- ccbb0369507f796db0b0ae6854c8a2be471b9d84
Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.
Log source
- product
- linux
- service
- auditd
Detection
selection_syscall_record_type:
type: 'SYSCALL'
exe|endswith: '/useradd'
selection_add_user_record_type:
type: 'ADD_USER' # This is logged without having to configure audit rules on both Ubuntu and Centos
condition: 1 of selection_*False positives (as the rule lists them)
- Admin activity
Tags
- attack.t1136.001
- attack.persistence
MITRE ATT&CK ids this rule names
References
- https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-understanding_audit_log_files
- https://access.redhat.com/articles/4409591#audit-record-types-2
- https://www.youtube.com/watch?v=VmvY5SQm5-Y&ab_channel=M45C07
Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/auditd/syscall/lnx_auditd_create_account.yml
Sources and licences
SigmaHQ
"Creation Of An User Account" by Marie Euler, Pawel Mazur (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/auditd/syscall/lnx_auditd_create_account.yml.
Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License
Cite this page
Dragons Eye Ransomware Tracker, "Sigma rule: Creation Of An User Account",
entity page, dataset version ref-2918407c2b49, updated 2022-12-20T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/759d0d51-bc99-4b5e-9add-8f5b2c8e7512 (accessed 2026-11-03).
Underlying source: SigmaHQ rule 759d0d51-bc99-4b5e-9add-8f5b2c8e7512, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.
Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.