huntrule

Linux: New user created with UID=0 or GID=0/10/27 indicating privileged group access

Alerts on Linux user creation events that assign privileged UID/GID values like root, wheel, or sudo.

FreeReviewedSigma · High · v3
Product
linux
Author
Pawel Mazur (SigmaHQ), DRL 1.1
Published
2022-12-21
Updated
2026-07-31
AnalysisDetection
title: "Linux: New user created with UID=0 or GID=0/10/27 indicating privileged group access"
id: 8afac56c-d16a-4a3e-92dc-ab31e585c820
status: test
description: This rule flags Linux user creation events that include identifiers consistent with privileged access, matching new-user log entries where UID=0 or GID=0, GID=10, or GID=27. Assigning root-level or sudo/wheel-equivalent group membership during account creation can enable immediate privilege escalation and persistence. It relies on Linux authentication logs capturing useradd-style messages containing "new user" plus UID/GID fields.
references:
  - https://digital.nhs.uk/cyber-alerts/2018/cc-2825
  - https://linux.die.net/man/8/useradd
  - https://github.com/redcanaryco/atomic-red-team/blob/25acadc0b43a07125a8a5b599b28bbc1a91ffb06/atomics/T1136.001/T1136.001.md#atomic-test-5---create-a-new-user-in-linux-with-root-uid-and-gid
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_privileged_user_creation.yml
author: Pawel Mazur, Huntrule Team
date: 2022-12-21
modified: 2025-01-21
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1136.001
  - attack.t1098
logsource:
  product: linux
  definition: /var/log/secure on REHL systems or /var/log/auth.log on debian like Systems needs to be collected in order for this detection to work
detection:
  selection_new_user:
    - new user
  selection_uids_gids:
    - GID=0,
    - UID=0,
    - GID=10,
    - GID=27,
  condition: all of selection_*
falsepositives:
  - Administrative activity
level: high
license: DRL-1.1
related:
  - id: 0ac15ec3-d24f-4246-aa2a-3077bb1cf90e
    type: derived