lastlog

lastlog

Shows the last logon of each system account, detecting accounts that have never logged in or unexpected recent access.

Run it as part of account hygiene and the first sweep of an IR: lastlog lists each account with its last access (or 'Never logged in'). Accounts with 'Never logged in' that have a shell and sudo are candidates for an attacker's target (dormant accounts that nobody watches); accounts with a recent last logon from an origin that doesn't add up are a sign of stolen credential use. In an environment with hundreds of service accounts, the query answers 'which accounts are really alive?' — the inventory nobody maintains.

Don't use it as evidence of non-access: lastlog can be spoofed (the /var/log/lastlog file can be modified with root, and there are tools that touch it) and a careful attacker updates it after their session. It also doesn't see accesses that don't generate a session login (cron, services). On systems with many containers or system accounts, the output is long and noisy: filter by accounts with a shell or by those that aren't system accounts. And beware: on distros with lastlog disabled by systemd (the session service manages it), the file may not be updated — verify that your distro maintains it.