Suspicious Persistence Through Sudoers.d Files (via file_event)

title: Suspicious Persistence Through Sudoers.d Files (via file_event)
id: 19b3b236-7713-5b74-b991-6c3ad43078b0
status: stable
description: This rule detects the creation or modification of files within the "sudoers.d" directory on Linux systems. Such behavior may indicate an attempt to establish or maintain privilege escalation by granting specific users elevated permissions. Unauthorized changes to sudoers files are a common method used by adversaries to persist administrative access.
references:
    - https://attack.mitre.org/techniques/T1548/003/
    - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/apps/deployer.sh
author: Huntrule Team
date: 2026-07-17
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1548.003
logsource:
    product: linux
    category: file_event
detection:
    selection:
        TargetFilename|startswith: '/etc/sudoers.d/'
    filter_main_dpkg:
        Image|endswith: '/usr/bin/dpkg'
        TargetFilename: '/etc/sudoers.d/README.dpkg-new'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium