Linux Persistence via /etc/sudoers.d File Creation or Modification

ATT&CK techniques

Priv Esc → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1548.003Sudo and Sudo Caching
Defense Evasion
- T1548.003Sudo and Sudo Caching
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags file creation or changes targeting the /etc/sudoers.d/ directory on Linux. Altering sudoers drop-in files can allow an attacker or administrator process to grant elevated permissions to specific users, supporting privilege escalation persistence. It relies on Linux file event telemetry that includes the target file path and the initiating process image path for excluding a known dpkg-generated artifact.

Reporting behind it

Related detections4 linkedT1548.003 — drag to rearrange

Suspicious Sudoers NOPASSWD Rule Written For Passwordless Privilege Escalation

Suspicious macOS Privilege Escalation Piping Password to sudo

Linux sudo CVE-2019-14287 exploit attempt via unusual USER strings

Linux Sudo Privilege Escalation Attempt Matching CVE-2019-14287 Command-Line Pattern

Linux Persistence via /etc/sudoers.d File Creation or Modification

Pivot detection · T1548.003 · 4 related

Changelog

v3

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-persistence-attempts-by-creating-modifying-etc-sudoers-d-files-ddb26b76

title: Linux Persistence via /etc/sudoers.d File Creation or Modification
id: 7b275a20-6cd2-4fe0-84ad-58c939259740
status: test
description: This rule flags file creation or changes targeting the /etc/sudoers.d/ directory on Linux. Altering sudoers drop-in files can allow an attacker or administrator process to grant elevated permissions to specific users, supporting privilege escalation persistence. It relies on Linux file event telemetry that includes the target file path and the initiating process image path for excluding a known dpkg-generated artifact.
references:
  - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/apps/deployer.sh
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/file_event/file_event_lnx_persistence_sudoers_files.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-05
modified: 2026-03-18
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1548.003
logsource:
  product: linux
  category: file_event
detection:
  selection:
    TargetFilename|startswith: /etc/sudoers.d/
  filter_main_dpkg:
    Image|endswith: /usr/bin/dpkg
    TargetFilename: /etc/sudoers.d/README.dpkg-new
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Creation of legitimate files in sudoers.d folder as part of administrator work
level: medium
license: DRL-1.1
related:
  - id: ddb26b76-4447-4807-871f-1b035b2bfa5d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL