Linux Useradd with Privileged Options
This rule detects the use of the `useradd` command on Linux systems with options that grant elevated privileges or modify user home directory creation. Specifically, it looks for the creation of users with UID or GID 0 (root privileges), or options that prevent home directory creation (`--no-create-home` or `-M`), which can be indicative of malicious user account creation for persistence or privilege escalation.
Splunk (SPL)
