Techniques › T1036.010 › AN1078
AN1078 Analytic 1078
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects creation or renaming of accounts with names that closely match known service, root, or admin accounts. Behavior often follows account discovery or deletion, attempting to blend into system activity logs using trusted name conventions.</p>
- Detects
- T1036.010 Masquerade Account Name
- Part of
- DET0383 Detection Strategy for Masquerading via Account Name Similarity
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | adduser | DC0014 User Account Creation |
| auditd:SYSCALL | usermod, or account rename system calls | DC0010 User Account Modification |
| linux:osquery | Listing of /etc/passwd and /etc/shadow metadata | DC0013 User Account Metadata |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AllowedSystemAccounts | Whitelist of legitimate service accounts used for validation. |
LevenshteinThreshold | Edit distance sensitivity between created account and existing account names. |
ScriptInitiatorDetection | Whether to flag account creation events triggered from suspicious scripts or shell histories. |