Suspicious User Added To Root/Sudoers Group Via Usermod (via process_creation)

title: Suspicious User Added To Root/Sudoers Group Via Usermod (via process_creation)
id: ec936810-2111-59d1-910d-31c2793a12bc
status: stable
description: This rule detects use of the "usermod" binary to add users add users to the root or suoders groups
references:
    - https://pberba.github.io/security/2021/11/23/linux-threat-hunting-for-persistence-account-creation-manipulation/
    - https://www.configserverfirewall.com/ubuntu-linux/ubuntu-add-user-to-root-group/
author: Huntrule Team
date: 2026-06-30
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1098
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        Image|endswith: '/usermod'
        CommandLine|contains:
            - '-aG root'
            - '-aG sudoers'
    condition: selection
falsepositives:
    - Unknown
level: medium