Linux groupdel Execution Identified by Process Creation

Alerts when the Linux groupdel command is executed, indicating group deletion activity.

FreeUnreviewedSigmamediumv1

linux-groupdel-execution-identified-by-process-creation-8a46f16c

title: Linux groupdel Execution Identified by Process Creation
id: 7f62733d-7799-4380-a6e9-9fb8021f9f0b
status: test
description: This rule flags process executions of the groupdel binary by matching the executable path ending with '/groupdel'. Deleting groups can be used to disrupt access controls and reduce evidence of administrative changes. Attackers may leverage this command to cover tracks by removing group-related identity information. The detection relies on Linux process creation telemetry that includes the executed image path.
references:
  - https://linuxize.com/post/how-to-delete-group-in-linux/
  - https://www.cyberciti.biz/faq/linux-remove-user-command/
  - https://www.cybrary.it/blog/0p3n/linux-commands-used-attackers/
  - https://linux.die.net/man/8/groupdel
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_groupdel.yml
author: Tuan Le (NCSGroup), Huntrule Team
date: 2022-12-26
tags:
  - attack.impact
  - attack.t1531
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith: /groupdel
  condition: selection
falsepositives:
  - Legitimate administrator activities
level: medium
license: DRL-1.1
related:
  - id: 8a46f16c-8c4c-82d1-b121-0fdd3ba70a84
    type: derived

What it detects

This rule flags process executions of the groupdel binary by matching the executable path ending with '/groupdel'. Deleting groups can be used to disrupt access controls and reduce evidence of administrative changes. Attackers may leverage this command to cover tracks by removing group-related identity information. The detection relies on Linux process creation telemetry that includes the executed image path.

Known false positives

Legitimate administrator activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.