User mgmt binaries

Description

Detect activity by any programs that can manage users, passwords, or permissions (such as login, systemd, usermod, deluser, adduser, chpasswd, and others). sudo and su are excluded. Activity in containers is also excluded -- some containers create custom users on top of a base linux distribution at startup. Some innocuous command lines that don't actually change anything are excluded. You might want to consider applying this rule to container actions as well.

Query · falco

spawned_process and not container and proc.name in (user_mgmt_binaries) and not proc.name in (su, sudo, lastlog, nologin, unix_chkpwd) and not proc.pname in (cron_binaries, systemd, systemd.postins, udev.postinst, run-parts) and not proc.cmdline startswith "passwd -S" and not proc.cmdline startswith "useradd -D" and not proc.cmdline startswith "systemd --version" and not run_by_qualys and not run_by_sumologic_securefiles and not run_by_yum and not run_by_ms_oms and not run_by_google_accounts_daemon and not chage_list and not user_known_user_management_activities

Rule dependencies

Depends on

  • composes · Falco macro chage_list
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro run_by_google_accounts_daemon
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro run_by_ms_oms
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro run_by_qualys
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro run_by_sumologic_securefiles
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro run_by_yum
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro spawned_process
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_user_management_activities
    A shared condition, not a detection — not indexed on this site.

Analyst notes

User management binary command run outside of container | gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Raw source User mgmt binaries · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: User mgmt binaries
desc: 'Detect activity by any programs that can manage users, passwords, or permissions
  (such as login, systemd, usermod, deluser, adduser, chpasswd, and others). sudo
  and su are excluded. Activity in containers is also excluded -- some containers
  create custom users on top of a base linux distribution at startup. Some innocuous
  command lines that don''t actually change anything are excluded. You might want
  to consider applying this rule to container actions as well.

  '
condition: 'spawned_process and not container and proc.name in (user_mgmt_binaries)
  and not proc.name in (su, sudo, lastlog, nologin, unix_chkpwd) and not proc.pname
  in (cron_binaries, systemd, systemd.postins, udev.postinst, run-parts) and not proc.cmdline
  startswith "passwd -S" and not proc.cmdline startswith "useradd -D" and not proc.cmdline
  startswith "systemd --version" and not run_by_qualys and not run_by_sumologic_securefiles
  and not run_by_yum and not run_by_ms_oms and not run_by_google_accounts_daemon and
  not chage_list and not user_known_user_management_activities

  '
output: User management binary command run outside of container | gparent=%proc.aname[2]
  ggparent=%proc.aname[3] gggparent=%proc.aname[4] evt_type=%evt.type user=%user.name
  user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath
  parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags
priority: NOTICE
tags:
- maturity_incubating
- host
- users
- software_mgmt
- mitre_persistence
- T1098

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.