ATT&CK technique
View on MITRE ATT&CK →
T1098.007
Additional Local or Domain Groups
PersistencePrivilege Escalation
9 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Linux User Added to Privileged Group | production | 2026-10-09 |
| elastic | Spike in Group Management Events | production | 2026-09-18 |
| elastic | Unusual Group Name Accessed by a User | production | 2026-09-18 |
| elastic | Linux Group Creation | production | 2026-09-18 |
| elastic | Spike in Group Lifecycle Change Events | production | 2026-09-18 |
| elastic | Potential Admin Group Account Addition | production | 2026-09-18 |
| elastic | User Added to the Admin Group | production | 2026-09-18 |
| elastic | User Added to Privileged Group in Active Directory | production | 2026-09-18 |
| elastic | User or Group Creation/Modification | production | 2026-09-18 |