AN1613 Analytic 1613

Linux · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Enumeration of users and groups through suspicious shell commands or unauthorized access to /etc/passwd or /etc/shadow.</p>

Detects: T1087 Account Discovery
Part of: DET0587 Enumeration of User or Account Information Across Platforms

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log source	Channel	Data component
auditd:SYSCALL	`PATH`	DC0055 File Access
linux:Sysmon	`EventCode=1`	DC0032 Process Creation

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

Field	Description
`AccessedFile`	Tune based on file paths such as '/etc/passwd', '/etc/group', '/etc/shadow'.
`ParentProcessName`	Filter known admin processes to reduce false positives.