Linux userdel Execution: User Account Deletion via userdel
Flags Linux process executions of userdel, indicating possible user account deletion and related cleanup.
FreeReviewedSigma · Medium · v2
- Product
- linux
- Category
- process_creation
- Author
- Tuan Le (NCSGroup) (SigmaHQ), DRL 1.1
- Published
- 2022-12-26
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule alerts when the userdel binary is executed, indicating a system attempt to delete a local user account (and typically associated files). Attackers may use account deletion to remove evidence or reduce the visibility of their activity. It relies on Linux process creation telemetry that records the executed command path ending with '/userdel'.
Reporting behind it
- linuxize.comhttps://linuxize.com/post/how-to-delete-group-in-linux/
- cyberciti.bizhttps://www.cyberciti.biz/faq/linux-remove-user-command/
- cybrary.ithttps://www.cybrary.it/blog/0p3n/linux-commands-used-attackers/
- linux.die.nethttps://linux.die.net/man/8/userdel
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_userdel.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
linux-userdel-execution-indicates-account-deletion-08f26069
title: "Linux userdel Execution: User Account Deletion via userdel"
id: 71d8c62e-8dd0-4051-880a-8ed725967bbf
status: test
description: This rule alerts when the userdel binary is executed, indicating a system attempt to delete a local user account (and typically associated files). Attackers may use account deletion to remove evidence or reduce the visibility of their activity. It relies on Linux process creation telemetry that records the executed command path ending with '/userdel'.
references:
- https://linuxize.com/post/how-to-delete-group-in-linux/
- https://www.cyberciti.biz/faq/linux-remove-user-command/
- https://www.cybrary.it/blog/0p3n/linux-commands-used-attackers/
- https://linux.die.net/man/8/userdel
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_userdel.yml
author: Tuan Le (NCSGroup), Huntrule Team
date: 2022-12-26
tags:
- attack.impact
- attack.t1531
logsource:
product: linux
category: process_creation
detection:
selection:
Image|endswith: /userdel
condition: selection
falsepositives:
- Legitimate administrator activities
level: medium
license: DRL-1.1
related:
- id: 08f26069-6f80-474b-8d1f-d971c6fedea0
type: derived