Privileged User Has Been Created — Detection Rule

Detects the addition of a new user to a privileged group such as "root" or "sudo"

Read the full analysis on IntelFusions