Linux: usermod used to add users to root or sudoers groups
Detects usermod commands that append a user to root or sudoers groups, indicating potential privilege escalation persistence.
FreeReviewedSigma · Medium · v2
- Product
- linux
- Category
- process_creation
- Author
- TuanLe (GTSC) (SigmaHQ), DRL 1.1
- Published
- 2022-12-21
- Updated
- 2026-07-31
What it detects
This rule flags Linux process executions where the binary path ends with /usermod and the command line includes group-add options targeting root or sudoers. Attackers commonly use this pattern to grant persistent administrative privileges to an account without deploying new software. The detection relies on process creation telemetry with executable path and full command-line arguments.
Reporting behind it
- pberba.github.iohttps://pberba.github.io/security/2021/11/23/linux-threat-hunting-for-persistence-account-creation-manipulation/
- configserverfirewall.comhttps://www.configserverfirewall.com/ubuntu-linux/ubuntu-add-user-to-root-group/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_usermod_susp_group.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
linux-usermod-adds-user-to-root-or-sudoers-group-via-ag-6a50f16c
title: "Linux: usermod used to add users to root or sudoers groups"
id: 15b31beb-6a12-4a55-b411-3badfab2ee47
status: test
description: This rule flags Linux process executions where the binary path ends with /usermod and the command line includes group-add options targeting root or sudoers. Attackers commonly use this pattern to grant persistent administrative privileges to an account without deploying new software. The detection relies on process creation telemetry with executable path and full command-line arguments.
references:
- https://pberba.github.io/security/2021/11/23/linux-threat-hunting-for-persistence-account-creation-manipulation/
- https://www.configserverfirewall.com/ubuntu-linux/ubuntu-add-user-to-root-group/
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_usermod_susp_group.yml
author: TuanLe (GTSC), Huntrule Team
date: 2022-12-21
tags:
- attack.privilege-escalation
- attack.persistence
logsource:
product: linux
category: process_creation
detection:
selection:
Image|endswith: /usermod
CommandLine|contains:
- -aG root
- -aG sudoers
condition: selection
falsepositives:
- Legitimate administrator activities
level: medium
license: DRL-1.1
related:
- id: 6a50f16c-3b7b-42d1-b081-0fdd3ba70a73
type: derived