Make a service account look like an intrusion

short · 45 min · Objective 1.1

Task

Create the authentication patterns that identity detections fire on, then read them back out of the logs. The point is to learn which field separates a service account doing its job from an attacker using a stolen credential -- and to find out that sometimes no field does.

Steps

  1. On the Linux VM, create two accounts: alice (a person) and svc-report (a service account with a shell).
  2. Authenticate as alice interactively three times over the course of ten minutes, from the console.
  3. Authenticate as svc-report twelve times in two minutes over SSH from the Windows VM, using a key, running one command each time.
  4. Now do the thing that matters: authenticate as svc-report once, from the console, interactively, as though someone had stolen it.
  5. From the collector alone, write a rule in words that would catch step 4 and not steps 2 or 3. Then check whether the fields your rule needs are actually present in the log lines.

Verify

grep "Accepted" /var/log/auth.log | awk '{print $9}' | sort | uniq -c
grep -c "Accepted publickey for svc-report" /var/log/auth.log
grep -c "session opened for user svc-report by (uid=0)" /var/log/auth.log

The first shows the per-account counts. The second must be around twelve -- the service account's normal work. The third is step 4, and it must be exactly 1: the same account, authenticating a different way, is a different log line. If the third returns zero, your console login did not reach the log and you need to check PAM logging before drawing conclusions.

Notes

The detection you just wrote -- "this service account authenticated interactively" -- is one of the highest-value identity rules there is, and it depends entirely on the authentication method being logged, not just the account and the result.

Try it with a password instead of a key and see whether your rule still separates the two. It usually does not, which is why service accounts with passwords are worth a finding on their own.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.