User Added to Local Privileged Group on Linux

ᴅᴜᴛᴄʜʙᴏʏ 😎@dutchboy

•updated Nov 16, 2025•15•2•262

Detects when a user account is added to a local privileged group (sudo or wheel) on a Linux endpoint using the 'usermod' utility. This action grants the user administrative privileges and could be indicative of privilege escalation.