Linux userdel Execution Indicates Account Deletion

Flags Linux process executions of userdel, indicating possible user account deletion and related cleanup.

FreeUnreviewedSigmamediumv1

linux-userdel-execution-indicates-account-deletion-08f26069

title: Linux userdel Execution Indicates Account Deletion
id: 71d8c62e-8dd0-4051-880a-8ed725967bbf
status: test
description: This rule identifies process executions of the userdel command on Linux by matching the process image path ending with '/userdel'. Account deletion and related file removal can be used to disrupt access, reduce forensic artifacts, or clean up after other activity. It relies on Linux process creation telemetry that includes the executable path.
references:
  - https://linuxize.com/post/how-to-delete-group-in-linux/
  - https://www.cyberciti.biz/faq/linux-remove-user-command/
  - https://www.cybrary.it/blog/0p3n/linux-commands-used-attackers/
  - https://linux.die.net/man/8/userdel
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_userdel.yml
author: Tuan Le (NCSGroup), Huntrule Team
date: 2022-12-26
tags:
  - attack.impact
  - attack.t1531
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith: /userdel
  condition: selection
falsepositives:
  - Legitimate administrator activities
level: medium
license: DRL-1.1
related:
  - id: 08f26069-6f80-474b-8d1f-d971c6fedea0
    type: derived

What it detects

This rule identifies process executions of the userdel command on Linux by matching the process image path ending with '/userdel'. Account deletion and related file removal can be used to disrupt access, reduce forensic artifacts, or clean up after other activity. It relies on Linux process creation telemetry that includes the executable path.

Known false positives

Legitimate administrator activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.