Sigma rule: Privileged User Has Been Created

Rule

Title

Privileged User Has Been Created

Status

test

Level

high

Author

Pawel Mazur

Date

2022-12-21

Modified

2025-01-21

File

rules/linux/builtin/lnx_privileged_user_creation.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the addition of a new user to a privileged group such as "root" or "sudo"

Log source

product

linux

definition

/var/log/secure on REHL systems or /var/log/auth.log on debian like Systems needs to be collected in order for this detection to work

Detection

# Example of the events that could be observed when matching these would be as follow
#   Dec 21 16:42:19 testserver useradd[1337]: new user: name=butter1, UID=1000, GID=0, home=/root, shell=/bin/bash
#   Dec 21 17:13:54 testserver useradd[1337]: new user: name=john, UID=0, GID=0, home=/home/john, shell=/bin/bash
#   Dec 21 17:24:40 testserver useradd[1337]: new user: name=butter3, UID=1000, GID=10, home=/home/butter3, shell=/bin/bash
#   Dec 21 17:30:22 testserver useradd[1337]: new user: name=butter4, UID=1000, GID=27, home=/home/butter4, shell=/bin/bash
selection_new_user:
    - 'new user'
selection_uids_gids:
    - 'GID=0,' # root group
    - 'UID=0,' # root UID
    - 'GID=10,' # wheel group
    - 'GID=27,' # sudo group
condition: all of selection_*

False positives (as the rule lists them)

• Administrative activity

Tags

• attack.privilege-escalation
• attack.persistence
• attack.t1136.001
• attack.t1098

MITRE ATT&CK ids this rule names

• T1098
• T1136.001

References

• https://digital.nhs.uk/cyber-alerts/2018/cc-2825
• https://linux.die.net/man/8/useradd
• https://github.com/redcanaryco/atomic-red-team/blob/25acadc0b43a07125a8a5b599b28bbc1a91ffb06/atomics/T1136.001/T1136.001.md#atomic-test-5---create-a-new-user-in-linux-with-root-uid-and-gid

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/builtin/lnx_privileged_user_creation.yml