{"id":"0ac15ec3-d24f-4246-aa2a-3077bb1cf90e","title":"Privileged User Has Been Created","description":"Detects the addition of a new user to a privileged group such as \"root\" or \"sudo\"","author":"Pawel Mazur","status":"test","level":"high","date":"2022-12-21","modified":"2025-01-21","tags":["attack.privilege-escalation","attack.persistence","attack.t1136.001","attack.t1098"],"technique_ids":["T1098","T1136.001"],"logsource":{"product":"linux","definition":"/var/log/secure on REHL systems or /var/log/auth.log on debian like Systems needs to be collected in order for this detection to work"},"falsepositives":["Administrative activity"],"references":["https://digital.nhs.uk/cyber-alerts/2018/cc-2825","https://linux.die.net/man/8/useradd","https://github.com/redcanaryco/atomic-red-team/blob/25acadc0b43a07125a8a5b599b28bbc1a91ffb06/atomics/T1136.001/T1136.001.md#atomic-test-5---create-a-new-user-in-linux-with-root-uid-and-gid"],"source_path":"rules/linux/builtin/lnx_privileged_user_creation.yml","source_sha256":"d3077e7863686f8da3428c8b3d5ab819648fc0dbeead29ac1792ab138a28f967","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/builtin/lnx_privileged_user_creation.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Privileged User Has Been Created\nid: 0ac15ec3-d24f-4246-aa2a-3077bb1cf90e\nstatus: test\ndescription: Detects the addition of a new user to a privileged group such as \"root\" or \"sudo\"\nreferences:\n    - https://digital.nhs.uk/cyber-alerts/2018/cc-2825\n    - https://linux.die.net/man/8/useradd\n    - https://github.com/redcanaryco/atomic-red-team/blob/25acadc0b43a07125a8a5b599b28bbc1a91ffb06/atomics/T1136.001/T1136.001.md#atomic-test-5---create-a-new-user-in-linux-with-root-uid-and-gid\nauthor: Pawel Mazur\ndate: 2022-12-21\nmodified: 2025-01-21\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.t1136.001\n    - attack.t1098\nlogsource:\n    product: linux\n    definition: '/var/log/secure on REHL systems or /var/log/auth.log on debian like Systems needs to be collected in order for this detection to work'\ndetection:\n    # Example of the events that could be observed when matching these would be as follow\n    #   Dec 21 16:42:19 testserver useradd[1337]: new user: name=butter1, UID=1000, GID=0, home=/root, shell=/bin/bash\n    #   Dec 21 17:13:54 testserver useradd[1337]: new user: name=john, UID=0, GID=0, home=/home/john, shell=/bin/bash\n    #   Dec 21 17:24:40 testserver useradd[1337]: new user: name=butter3, UID=1000, GID=10, home=/home/butter3, shell=/bin/bash\n    #   Dec 21 17:30:22 testserver useradd[1337]: new user: name=butter4, UID=1000, GID=27, home=/home/butter4, shell=/bin/bash\n    selection_new_user:\n        - 'new user'\n    selection_uids_gids:\n        - 'GID=0,' # root group\n        - 'UID=0,' # root UID\n        - 'GID=10,' # wheel group\n        - 'GID=27,' # sudo group\n    condition: all of selection_*\nfalsepositives:\n    - Administrative activity\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1098","id":"T1098","name":"Account Manipulation","page":"techniques/enterprise/T1098/"},{"key":"enterprise/T1136.001","id":"T1136.001","name":"Local Account","page":"techniques/enterprise/T1136.001/"}],"data_path":"data/detection-rules/0ac15ec3-d24f-4246-aa2a-3077bb1cf90e.json","kind":"sigma"}