Sigma medium test sigma

User Added To Root/Sudoers Group Using Usermod

Detects usage of the "usermod" binary to add users add users to the root or suoders groups

View Source

Detection Logic

{
  "selection": {
    "Image
| endswith": "/usermod",
    "CommandLine
| contains": [
      "-aG root",
      "-aG sudoers"
    ]
  },
  "condition": "selection"
}

False Positives

  • ⚠ Legitimate administrator activities

Field Validations

Loading…

Comments (0)

Loading comments...