0002-user-del - Host User Deleted¶

Rule ID¶

• 0002-user-del

Category¶

• system

Severity¶

• warn

Compatible Versions¶

• Linux

Description¶

• Monitors whether the host has deleted users.

Scan Frequency¶

• disable

Rationale¶

• Deleting a user on a host is a normal operation, but if an unknown user is deleted, it may cause host information security breaches. Therefore, this action should be audited.

Risk Items¶

• Hacker intrusion
• Data leakage
• Network security breach
• Cryptojacking risk
• Botnet risk

Audit Method¶

• Verify whether the host has deleted a user. You can run the following command:

cat /etc/passwd |cut -f 1 -d :

Remediation¶

• If a user is deleted on the host, carefully review the user information.

Impact¶

• None

Default Value¶

• None

References¶

• None

CIS Controls¶

• None