Privileged User Account Creation on Linux

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•52

Detects the creation of a new user account with privileged User ID (UID) or Group ID (GID) on Linux systems, specifically targeting root (UID=0, GID=0), wheel (GID=10), or sudo (GID=27) groups. This rule monitors logs for `useradd` events indicating the creation of users with these elevated privileges.