Audit Account Creation, Modification, and Deletion Account creations and account modfications, such as disablement and termination, can all be signs of an intrusion and should be audited. Once an attacker establishes access to a system, the attacker may attempt to create an account to reestablish access at a later time. The attacker may also attempt to modify accounts in an attempt to change an existing account's privileges or disable or delete accounts in a denial-of-service attack. Auditing of account creation, modification, disabling, and termination events mitigates this risk. [exists/does_not_exist] In order to view the currently configured flags for the audit daemon, run the following command: sudo grep ^flags /etc/security/audit_control Privileged access, including the creation, modification, and deletion of local user accounts, is logged via the 'ad' flag. If 'ad' is not listed in the result of the check, this is a finding. oval:org.secpod.oval:def:25046 SCAP Repo OVAL Definition 2015-06-12