Linux: New User Created With Privileged UID/GID Values

title: "Linux: New User Created With Privileged UID/GID Values"
id: 8afac56c-d16a-4a3e-92dc-ab31e585c820
status: test
description: This rule flags Linux account creation events where the new user is associated with privileged identity values, such as UID=0 (root), GID=0 (root group), GID=10 (wheel), or GID=27 (sudo). Attackers often create or add privileged users to persist access and bypass authorization controls. It relies on Linux authentication/user-management log messages (e.g., useradd-style entries) that include “new user” plus UID/GID fields.
references:
  - https://digital.nhs.uk/cyber-alerts/2018/cc-2825
  - https://linux.die.net/man/8/useradd
  - https://github.com/redcanaryco/atomic-red-team/blob/25acadc0b43a07125a8a5b599b28bbc1a91ffb06/atomics/T1136.001/T1136.001.md#atomic-test-5---create-a-new-user-in-linux-with-root-uid-and-gid
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_privileged_user_creation.yml
author: Pawel Mazur, Huntrule Team
date: 2022-12-21
modified: 2025-01-21
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1136.001
  - attack.t1098
logsource:
  product: linux
  definition: /var/log/secure on REHL systems or /var/log/auth.log on debian like Systems needs to be collected in order for this detection to work
detection:
  selection_new_user:
    - new user
  selection_uids_gids:
    - GID=0,
    - UID=0,
    - GID=10,
    - GID=27,
  condition: all of selection_*
falsepositives:
  - Administrative activity
level: high
license: DRL-1.1
related:
  - id: 0ac15ec3-d24f-4246-aa2a-3077bb1cf90e
    type: derived