Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0003 ✕

Download CSV Show ATT&CK heatmap
  • Linux local user account creation Informational Identity Analytics 1 variation

    A user executed a process associated with user account creation.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Valid Accounts (T1078) Valid Accounts: Local Accounts (T1078.003)
    Required data: XDR Agent
    Attacker's goals: Persistence using a valid account.
    Investigative actions: Check the user who created the account and verify its activity. Investigate whether the same account was created on different hosts as part of an installation process.

    Variations

    Linux local user account creation by non-root user

    Low overridden

    A non-root user executed a process associated with user account creation. This user does not regularly create accounts. overridden