• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Usermod to root

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Luís Marques@remotecodeexecution
    •updated Jul 6, 2026•13•0•6

    Detects the use of the usermod to modify the users permissions. Which can be an indication of privilege escalation attempts on Linux systems

    Sigma

    Tags

    TA0004 - Privilege EscalationT1548.001 - Setuid and SetgidT1548 - Abuse Elevation Control MechanismTA0005 - Defense EvasionProcess CreationLinuxattack.privilege-escalationattack.t1548.001

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?