Linux User Account Creation
Detects the creation of a new user account on Linux systems. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system. The rule specifically looks for 'SYSCALL' events where the executable ends with '/useradd' or 'ADD_USER' record types from auditd logs.
Sigma
