lastlog
Show the most recent login of all users or of a user. tldr-pages
On Linux 1 Sigma rule name it
Linux
Display the most recent login of all users
lastlogIdentifyTrips 1 Sigma rule: lowLocal System Accounts Discovery Attempt - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad
Display the lastlog record of the specified user
lastlog --user usernameIdentifyTrips 1 Sigma rule: lowLocal System Accounts Discovery Attempt - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad
Display records older than 7 days
lastlog --before 7IdentifyTrips 1 Sigma rule: lowLocal System Accounts Discovery Attempt - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad
Display records more recent than 3 days
lastlog --time 3IdentifyTrips 1 Sigma rule: lowLocal System Accounts Discovery Attempt - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad