Linux usermod adds user to root or sudoers group via -aG

Detects usermod commands that append a user to root or sudoers groups, indicating potential privilege escalation persistence.

FreeUnreviewedSigmamediumv1

linux-usermod-adds-user-to-root-or-sudoers-group-via-ag-6a50f16c

title: Linux usermod adds user to root or sudoers group via -aG
id: 15b31beb-6a12-4a55-b411-3badfab2ee47
status: test
description: This rule flags process executions of the usermod binary where the command line includes arguments to append a user to the root group ("-aG root") or the sudoers group ("-aG sudoers"). Such changes directly grant elevated privileges and can be used to establish persistence by modifying account authorization. It relies on Linux process creation telemetry capturing the executable path and command-line arguments.
references:
  - https://pberba.github.io/security/2021/11/23/linux-threat-hunting-for-persistence-account-creation-manipulation/
  - https://www.configserverfirewall.com/ubuntu-linux/ubuntu-add-user-to-root-group/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_usermod_susp_group.yml
author: TuanLe (GTSC), Huntrule Team
date: 2022-12-21
tags:
  - attack.privilege-escalation
  - attack.persistence
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith: /usermod
    CommandLine|contains:
      - -aG root
      - -aG sudoers
  condition: selection
falsepositives:
  - Legitimate administrator activities
level: medium
license: DRL-1.1
related:
  - id: 6a50f16c-3b7b-42d1-b081-0fdd3ba70a73
    type: derived

What it detects

This rule flags process executions of the usermod binary where the command line includes arguments to append a user to the root group ("-aG root") or the sudoers group ("-aG sudoers"). Such changes directly grant elevated privileges and can be used to establish persistence by modifying account authorization. It relies on Linux process creation telemetry capturing the executable path and command-line arguments.

Known false positives

Legitimate administrator activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.