Potential SSH with System User

id: '8620.11045'
title: Potential SSH with System User
description: 'NIX System users, typically 1…999 are users that do not map to actual
  “human” users, but are used as security identities for system daemons, in order
  to implement privilege separation and run system daemons with minimal privileges.
  This use case looks for attempts to ssh into and user account with a "Default" user
  id for most NIX distributions. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` type=USER_START | regex auid=^\d+|
  regex auid!="0|\d{4,}"| regex exe="(?i)ssh" | eval src_ip=addr, user=coalesce(acct,
  id, ID) | table _time, host, user src_ip, process_*, user `group_events(host, 1)`
  | lookup dnslookup clientip as src_ip OUTPUT clienthost as src_dns | iplocation
  prefix="src_" src_ip | rename src_Country as src_country '
techniques:
- privilege-escalation:valid accounts:default accounts
- defense-evasion:valid accounts:default accounts
- persistence:valid accounts:default accounts
technique_id:
- T1078.001
data_category:
- Linux audit logs
references:
- https://systemd.io/UIDS-GIDS/