Data Source: Linux Auditd Add User

Created: 2024-08-08

Last Updated: 2026-10-14

ID: 30f79353-e1d2-4585-8735-1e0359559f3f

Author: Teoderick Contreras, Splunk

Description

Logs activities related to the addition of a new user account on a Linux system, including details about the username, UID, and the process initiating the action.

Details

Property	Value
Source	`auditd`
Sourcetype	`auditd`
Separator	type

Name ▲▼	Technique ▲▼	Type ▲▼
Linux Auditd Add User Account Type	Local Account	Anomaly

Supported Apps

Splunk Add-on for Unix and Linux (version 10.3.4)

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">addr</span>
  
  <span class="pill kill-chain">AUID</span>
  
  <span class="pill kill-chain">auid</span>
  
  <span class="pill kill-chain">date_hour</span>
  
  <span class="pill kill-chain">date_mday</span>
  
  <span class="pill kill-chain">date_minute</span>
  
  <span class="pill kill-chain">date_month</span>
  
  <span class="pill kill-chain">date_second</span>
  
  <span class="pill kill-chain">date_wday</span>
  
  <span class="pill kill-chain">date_year</span>
  
  <span class="pill kill-chain">date_zone</span>
  
  <span class="pill kill-chain">eventtype</span>
  
  <span class="pill kill-chain">exe</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">hostname</span>
  
  <span class="pill kill-chain">ID</span>
  
  <span class="pill kill-chain">id</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">msg</span>
  
  <span class="pill kill-chain">op</span>
  
  <span class="pill kill-chain">pid</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">res</span>
  
  <span class="pill kill-chain">ses</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">subj</span>
  
  <span class="pill kill-chain">tag</span>
  
  <span class="pill kill-chain">tag::eventtype</span>
  
  <span class="pill kill-chain">terminal</span>
  
  <span class="pill kill-chain">timeendpos</span>
  
  <span class="pill kill-chain">timestartpos</span>
  
  <span class="pill kill-chain">type</span>
  
  <span class="pill kill-chain">UID</span>
  
  <span class="pill kill-chain">uid</span>
  
</div>

Example Log

1type=ADD_USER msg=audit(1722950859.266:6994): pid=1788 uid=0 auid=1000 ses=1 subj=unconfined msg='op=adding user id=1002 exe="/usr/sbin/useradd" hostname=ar-linux1 addr=? terminal=pts/1 res=success'
2UID="root" AUID="ubuntu" ID="unknown(1002)"

Source: GitHub | Version: 4