usermod

Modify a user account. tldr-pages

On Linux 1 Sigma rule name it

Linux

Change a username

sudo usermod --login new_username usernameIdentify

Change a user ID

sudo usermod --uid user_id usernameIdentify

Change a user shell

sudo usermod --shell path/to/shell usernameIdentify

Add a user to supplementary groups (mind the lack of whitespace)

sudo usermod --append --groups group1,group2,... usernameIdentify

Remove a user from specific groups

sudo usermod --remove --groups group1,group2,... usernameIdentify

Change a user home directory

sudo usermod --move-home --home path/to/new_home usernameIdentify

Lock an account

sudo usermod --lock usernameIdentify

Unlock an account

sudo usermod --unlock usernameIdentify

Sigma process creation rules that name usermod