Linux User Added to Privileged Group

process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
process.executable != null and process.args in (
  "root", "admin", "wheel", "staff", "sudo","disk", "video", "shadow", "lxc", "lxd"
) and
(
  process.name in ("usermod", "adduser") or
  (process.name == "gpasswd" and process.args in ("-a", "--add", "-M", "--members"))
) and
not (
  ?process.parent.executable like (
    "/usr/lib/google/guest_agent/core_plugin", "/usr/libexec/platform-python*", "/usr/lib/google/guest_agent/GuestAgentCorePlugin/core_plugin",
    "/usr/bin/google_guest_agent"
  ) or
  (
    ?process.entry_leader.executable == "/usr/lib/venv-salt-minion/bin/python.original" and
    ?process.entry_leader.args == "/usr/lib/venv-salt-minion/bin/salt-minion"
  )
)