Linux sudoers persistence via /etc/sudoers or /etc/sudoers.d file changes

ATT&CK techniques

Priv Esc → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1548.003Sudo and Sudo Caching
Defense Evasion
- T1548.003Sudo and Sudo Caching
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags file creation or modification events for the main /etc/sudoers file and any file under the /etc/sudoers.d/ directory on Linux. Changes to sudoers configuration can enable attackers to run commands with elevated privileges without interactive password prompts. The detection relies on Linux file event telemetry that records the target filename, excluding a specific dpkg-related temporary sudoers.d README.dpkg-new path.

Reporting behind it

Related detections5 linkedT1548.003 — drag to rearrange

Suspicious su Execution From Uncommon Parent Process on Linux (via process_creation)

Suspicious Sudoers NOPASSWD Rule Written For Passwordless Privilege Escalation

Suspicious macOS Privilege Escalation Piping Password to sudo

Linux sudo CVE-2019-14287 exploit attempt via unusual USER strings

Linux Sudo Privilege Escalation Attempt Matching CVE-2019-14287 Command-Line Pattern

Linux sudoers persistence via /etc/sudoers or /etc/sudoers.d file changes

Pivot detection · T1548.003 · 5 related

Changelog

v5

v5
Candidate ingested via manual entry.2026-09-24
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-persistence-attempts-by-creating-modifying-etc-sudoers-d-files-ddb26b76

title: Linux sudoers persistence via /etc/sudoers or /etc/sudoers.d file changes
id: 7b275a20-6cd2-4fe0-84ad-58c939259740
status: test
description: This rule flags file creation or modification events for the main /etc/sudoers file and any file under the /etc/sudoers.d/ directory on Linux. Changes to sudoers configuration can enable attackers to run commands with elevated privileges without interactive password prompts. The detection relies on Linux file event telemetry that records the target filename, excluding a specific dpkg-related temporary sudoers.d README.dpkg-new path.
references:
  - https://www.sudo.ws/docs/man/sudoers.man/
  - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/apps/deployer.sh
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/file_event/file_event_lnx_persistence_sudoers_files.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-05
modified: 2026-08-15
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1548.003
logsource:
  product: linux
  category: file_event
detection:
  selection:
    - TargetFilename: /etc/sudoers
    - TargetFilename|startswith: /etc/sudoers.d/
  filter_main_dpkg:
    Image|endswith: /usr/bin/dpkg
    TargetFilename: /etc/sudoers.d/README.dpkg-new
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate sudoers changes by administrators or configuration-management tools
level: medium
license: DRL-1.1
related:
  - id: ddb26b76-4447-4807-871f-1b035b2bfa5d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL