Legitimate user or hacker -Terminal?
All users account starting with an _ are automatically generated by the system. For example, _lp is an account used to manage the Printing Services without the use of the priviledged account root.
This is a separation of priviledges and a good protection.
For all other account names,
daemon and nobody are also generated by the system.
For the remaining accounts, let's say you see a suspect user account bond, use the following command:
finger bond
to check what bond account is used for and when it was last used to connect on your system.