Merge PR #5166 from @frack113 - Fix Privileged User Has Been Created

fix: Privileged User Has Been Created - Add missing comma to avoid false positives

Author: frack113

rules/linux/builtin/lnx_privileged_user_creation.yml

@@ -8,6 +8,7 @@ references:
     - https://github.com/redcanaryco/atomic-red-team/blob/25acadc0b43a07125a8a5b599b28bbc1a91ffb06/atomics/T1136.001/T1136.001.md#atomic-test-5---create-a-new-user-in-linux-with-root-uid-and-gid
 author: Pawel Mazur
 date: 2022-12-21
+modified: 2025-01-21
 tags:
     - attack.persistence
     - attack.t1136.001
@@ -24,10 +25,10 @@ detection:
     selection_new_user:
         - 'new user'
     selection_uids_gids:
-        - 'GID=0' # root group
-        - 'UID=0' # root UID
-        - 'GID=10' # wheel group
-        - 'GID=27' # sudo group
+        - 'GID=0,' # root group
+        - 'UID=0,' # root UID
+        - 'GID=10,' # wheel group
+        - 'GID=27,' # sudo group
     condition: all of selection_*
 falsepositives:
     - Administrative activity