Persistence Via Sudoers Files

calendar Sep 24, 2026 · attack.privilege-escalation attack.persistence attack.t1548.003  ·
Share on: linkedin copy

Detects the creation or modification of the main "/etc/sudoers" file or files within the "/etc/sudoers.d/" directory on Linux systems. Adversaries may alter sudoers configuration to execute commands with elevated privileges without supplying a password.

Sigma rule (View on GitHub)

 1title: Persistence Via Sudoers Files
 2id: ddb26b76-4447-4807-871f-1b035b2bfa5d
 3status: test
 4description: |
 5    Detects the creation or modification of the main "/etc/sudoers" file or files within the "/etc/sudoers.d/" directory on Linux systems.
 6    Adversaries may alter sudoers configuration to execute commands with elevated privileges without supplying a password.    
 7references:
 8    - https://www.sudo.ws/docs/man/sudoers.man/
 9    - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/apps/deployer.sh
10author: Nasreddine Bencherchali (Nextron Systems)
11date: 2022-07-05
12modified: 2026-08-15
13tags:
14    - attack.privilege-escalation
15    - attack.persistence
16    - attack.t1548.003
17logsource:
18    product: linux
19    category: file_event
20detection:
21    selection:
22        - TargetFilename: '/etc/sudoers'
23        - TargetFilename|startswith: '/etc/sudoers.d/'
24    filter_main_dpkg:
25        Image|endswith: '/usr/bin/dpkg'
26        TargetFilename: '/etc/sudoers.d/README.dpkg-new'
27    condition: selection and not 1 of filter_main_*
28falsepositives:
29    - Legitimate sudoers changes by administrators or configuration-management tools
30level: medium

References

  • Sudoers Manual

    NAME sudoers — default sudo security policy plugin DESCRIPTION The sudoers policy plugin determines a user's sudo privileges. It is the default sudo policy plugin. The policy is driven by the /etc/sudoers file or, optionally, in LDAP. The policy format is described in detail in the SUDOERS FILE FORMAT section. For information on storing sudoers policy information in LDAP, see sudoers.ldap(5). Configuring sudo.conf for sudoers sudo consults the sudo.conf(5) file to determine which plugins to load. If no sudo.conf(5) file is present, or if it contains no Plugin lines, sudoers will be used for auditing, policy decisions and I/O logging. To explicitly configure sudo.conf(5) to use the sudoers plugin, the following configuration can be used.


    Read More

  • https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/apps/deployer.sh


    Read More

Related rules

to-top