huntrule

Linux groupdel Executed to Delete a User Group

Alerts when the Linux groupdel command is executed, indicating group deletion activity.

FreeReviewedSigma · Medium · v2
Product
linux
Category
process_creation
Author
Tuan Le (NCSGroup) (SigmaHQ), DRL 1.1
Published
2022-12-26
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Impact

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies process executions where the binary path ends with /groupdel, indicating a user group deletion attempt on Linux systems. Attackers may use group deletion to disrupt access and potentially reduce forensic artifacts. Detection relies on process creation telemetry that includes the executed image path.

Reporting behind it

Related detections9 linkedT1531 — drag to rearrange
Suspicious Account Disable via net user active no (via process_creation)
AWS IAM SAML Provider Deletion via CloudTrail
Linux userdel Execution: User Account Deletion via userdel
Windows Security Logoff Events (Event ID 4634/4647)
Windows PowerShell Script: Remove Account From Domain Admin Group via Remove-ADGroupMember
Okta User Account Lockout Triggered by Max Sign-In Attempts
Google Cloud: Service Account Disabled or Deleted via IAM Audit Events
Azure Kubernetes Service Service Account Modified or Deleted Activity Log Events
AWS ElastiCache Cache Security Group Modified or Deleted via CloudTrail
Linux groupdel Executed to Delete a User Group
Pivot detection · T1531 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.