User Added To Root/Sudoers Group Using Usermod

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•24

Detects the usage of the 'usermod' command to add a user to either the 'root' or 'sudoers' group on a Linux system. This activity can indicate privilege escalation or persistence mechanisms by an attacker.