Detection rules › Panther
Teleport Create User Accounts
A user has been manually created, modified, or deleted
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1136 Create Account |
Rule body yaml
AnalysisType: rule
Filename: teleport_create_user_accounts.py
RuleID: "Teleport.CreateUserAccounts"
DisplayName: "Teleport Create User Accounts"
Enabled: true
LogTypes:
- Gravitational.TeleportAudit
Tags:
- SSH
- Persistence:Create Account
Reports:
MITRE ATT&CK:
- TA0003:T1136
Severity: High
Description: A user has been manually created, modified, or deleted
DedupPeriodMinutes: 15
Reference: https://goteleport.com/docs/management/admin/
Runbook: Analyze why it was manually created and delete it if necessary.
SummaryAttributes:
- event
- code
- user
- program
- path
- return_code
- login
- server_id
- sid
Tests:
- Name: Echo command
ExpectedResult: false
Log:
{
"argv": [],
"cgroup_id": 4294967537,
"code": "T4000I",
"ei": 15,
"event": "session.command",
"login": "root",
"namespace": "default",
"path": "/bin/echo",
"pid": 7143,
"ppid": 7115,
"program": "echo",
"return_code": 0,
"server_id": "e75992b4-9e27-456f-b1c9-7a32da83c661",
"sid": "8a3fc038-785b-43f3-8737-827b3e25fe5b",
"time": "2020-08-17T17:40:37.491Z",
"uid": "8eaf8f39-09d4-4a42-a22a-65163d2af702",
"user": "panther",
}
- Name: Userdel command
ExpectedResult: true
Log:
{
"argv": ["jacknew"],
"cgroup_id": 4294967567,
"code": "T4000I",
"ei": 105,
"event": "session.command",
"login": "root",
"namespace": "default",
"path": "/sbin/userdel",
"pid": 8931,
"ppid": 8930,
"program": "userdel",
"return_code": 0,
"server_id": "e75992b4-9e27-456f-b1c9-7a32da83c661",
"sid": "4244c271-8069-4679-a27e-f7c18f88ce45",
"time": "2020-08-17T18:39:26.192Z",
"uid": "346d3f61-a010-4871-84de-897f50b18118",
"user": "panther",
}
Detection logic
Condition
event eq "session.command"
program wildcard "chage" or program wildcard "passwd" or program wildcard "user*"
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field |
|---|
user |
cluster_name |