Persistence Via Sudoers.d Files

Status: test
Severity: medium
Log source: category file_event, product linux
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the creation or modification of files within the "sudoers.d" directory on Linux systems. Such activity may indicate an attempt to establish or maintain privilege escalation by granting specific users elevated permissions. Unauthorized changes to sudoers files are a common technique used by attackers to persist administrative access.

Known false positives

Creation of legitimate files in sudoers.d folder as part of administrator work

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1548.003` Abuse Elevation Control Mechanism: Sudo and Sudo Caching

Telemetry coverage

Platform	Record / event type
Linux	Event ID 11: File created

Rule body

title: Persistence Via Sudoers.d Files
id: ddb26b76-4447-4807-871f-1b035b2bfa5d
status: test
description: |
    Detects the creation or modification of files within the "sudoers.d" directory on Linux systems.
    Such activity may indicate an attempt to establish or maintain privilege escalation by granting specific users elevated permissions.
    Unauthorized changes to sudoers files are a common technique used by attackers to persist administrative access.
references:
    - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/apps/deployer.sh
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-05
modified: 2026-03-18
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1548.003
logsource:
    product: linux
    category: file_event
detection:
    selection:
        TargetFilename|startswith: '/etc/sudoers.d/'
    filter_main_dpkg:
        Image|endswith: '/usr/bin/dpkg'
        TargetFilename: '/etc/sudoers.d/README.dpkg-new'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Creation of legitimate files in sudoers.d folder as part of administrator work
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    TargetFilename|startswith: '/etc/sudoers.d/'

Stage 2: `not filter_main_dpkg`

filter_main_dpkg:
    Image|endswith: '/usr/bin/dpkg'
    TargetFilename: '/etc/sudoers.d/README.dpkg-new'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	ends_with	`/usr/bin/dpkg`	`excludes:Image` `field:"Image" value:"/usr/bin/dpkg"`
`TargetFilename`	eq	`/etc/sudoers.d/README.dpkg-new`	`excludes:TargetFilename` `field:"TargetFilename" value:"/etc/sudoers.d/README.dpkg-new"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetFilename`	starts_with	`/etc/sudoers.d/`	`field:"TargetFilename" kind:starts_with value:"/etc/sudoers.d/"`