This rule detects the use of the Linux usermod utility to assign a UID of 0 to a user, effectively creating or elevating a root-level account. Achieving UID 0 can bypass normal privilege escalation controls and grant attacker control while appearing as a standard user in monitoring tools. The detection relies on endpoint telemetry (EDR) ingested into Splunk and targets the usermod process invoked with command-line options that set the UID to zero (for example, -u 0, --uid 0, or variants like * -u 0 *). The search aggregates data from the Endpoint.Processes data model, correlating the action, destination, original file, and detailed process lineage (including parent process name, path, and IDs) to identify suspicious invocations. A dedicated linux_usermod_root_uid_set_filter is applied to reduce noise. The rule is mapped to Linux privilege escalation and persistence techniques and includes a MITRE ATT&CK alignment (T1098, T1078, T1548.001). It leverages the Splunk CIM for field normalization and requires full command-line and process lineage data to be ingested (including process GUID, parent process details, and the complete command line). The finding format surfaces the targeted user, destination host, and the process name, with intermediate findings highlighting potential root-UID set activity. Drilldowns provide per-user/per-host views and risk-scoring hops. The rule includes a test dataset to validate true positives and references an example attack dataset. Overall, this rule is designed to minimize false positives (uid 0 assignments are rare in legitimate administration) while enabling rapid investigation of suspected root-level account manipulations.