0001-user-add-Host Add New User¶

Rule ID¶

• 0001-user-add

Category¶

• system

Level¶

• warn

Compatible Versions¶

• Linux

Description¶

• Monitor whether the host adds an unknown user

Scan Frequency¶

• disable

Theoretical Basis¶

• Adding a user to a host is a normal behavior. However, if an unknown user is added to the host, it can cause information security leakage. Therefore, it needs to be included in the audit scope.

Risk Items¶

• Hacker infiltration

• Data leakage

• Network security

• Cryptomining risk

• Botnet risk

Audit Method¶

• Verify whether the host has added a user. You can run the following command to verify:

cat /etc/passwd |cut -f 1 -d :

Remediation¶

• If the host has added an unknown user, carefully review the user information. If a suspicious user exists, delete the user and change the login passwords of other users.

userdel xxx

Impact¶

• None

Default Value¶

• None

References¶

• None

CIS Controls¶

• None