Linux groupdel Executed to Delete a User Group
Alerts when the Linux groupdel command is executed, indicating group deletion activity.
FreeReviewedSigma · Medium · v2
- Product
- linux
- Category
- process_creation
- Author
- Tuan Le (NCSGroup) (SigmaHQ), DRL 1.1
- Published
- 2022-12-26
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule identifies process executions where the binary path ends with /groupdel, indicating a user group deletion attempt on Linux systems. Attackers may use group deletion to disrupt access and potentially reduce forensic artifacts. Detection relies on process creation telemetry that includes the executed image path.
Reporting behind it
- linuxize.comhttps://linuxize.com/post/how-to-delete-group-in-linux/
- cyberciti.bizhttps://www.cyberciti.biz/faq/linux-remove-user-command/
- cybrary.ithttps://www.cybrary.it/blog/0p3n/linux-commands-used-attackers/
- linux.die.nethttps://linux.die.net/man/8/groupdel
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_groupdel.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
linux-groupdel-execution-identified-by-process-creation-8a46f16c
title: Linux groupdel Executed to Delete a User Group
id: 7f62733d-7799-4380-a6e9-9fb8021f9f0b
status: test
description: This rule identifies process executions where the binary path ends with /groupdel, indicating a user group deletion attempt on Linux systems. Attackers may use group deletion to disrupt access and potentially reduce forensic artifacts. Detection relies on process creation telemetry that includes the executed image path.
references:
- https://linuxize.com/post/how-to-delete-group-in-linux/
- https://www.cyberciti.biz/faq/linux-remove-user-command/
- https://www.cybrary.it/blog/0p3n/linux-commands-used-attackers/
- https://linux.die.net/man/8/groupdel
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_groupdel.yml
author: Tuan Le (NCSGroup), Huntrule Team
date: 2022-12-26
tags:
- attack.impact
- attack.t1531
logsource:
product: linux
category: process_creation
detection:
selection:
Image|endswith: /groupdel
condition: selection
falsepositives:
- Legitimate administrator activities
level: medium
license: DRL-1.1
related:
- id: 8a46f16c-8c4c-82d1-b121-0fdd3ba70a84
type: derived