Linux Useradd with Root Privileges

Danny Y@zendannyy

•updated Feb 25, 2026•9•1•104

Detects the creation of new user accounts on Linux systems using the 'useradd' command with parameters that grant root (UID 0 or GID 0) privileges, or prevent home directory creation, which can indicate a backdoor account.