Linux Persistence Attempts by Creating/Modifying /etc/sudoers.d Files

Alerts on file changes in /etc/sudoers.d/ that may indicate persistence via sudo privilege policy.

FreeUnreviewedSigmamediumv1

linux-persistence-attempts-by-creating-modifying-etc-sudoers-d-files-ddb26b76

title: Linux Persistence Attempts by Creating/Modifying /etc/sudoers.d Files
id: 7b275a20-6cd2-4fe0-84ad-58c939259740
status: test
description: This rule flags file creation or changes under /etc/sudoers.d/, which controls per-user sudo privileges on Linux. Attackers can abuse this location to persist elevated access by adding or modifying sudo policy files for specific accounts. The detection relies on Linux file event telemetry that includes the target filename and the creating/modifying process image, and it suppresses a specific dpkg-generated temporary file.
references:
  - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/apps/deployer.sh
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/file_event/file_event_lnx_persistence_sudoers_files.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-05
modified: 2026-03-18
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1548.003
logsource:
  product: linux
  category: file_event
detection:
  selection:
    TargetFilename|startswith: /etc/sudoers.d/
  filter_main_dpkg:
    Image|endswith: /usr/bin/dpkg
    TargetFilename: /etc/sudoers.d/README.dpkg-new
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Creation of legitimate files in sudoers.d folder as part of administrator work
level: medium
license: DRL-1.1
related:
  - id: ddb26b76-4447-4807-871f-1b035b2bfa5d
    type: derived

What it detects

This rule flags file creation or changes under /etc/sudoers.d/, which controls per-user sudo privileges on Linux. Attackers can abuse this location to persist elevated access by adding or modifying sudo policy files for specific accounts. The detection relies on Linux file event telemetry that includes the target filename and the creating/modifying process image, and it suppresses a specific dpkg-generated temporary file.

Known false positives

Creation of legitimate files in sudoers.d folder as part of administrator work

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.