Persistence Via Sudoers.d Files — Sigma Rule

Rule metadata and linked tags

Author: Nasreddine Bencherchali (Nextron Systems). Source status: test; severity: medium. Source dates: 2022-07-05 / 2026-03-18.

{
  "product": "linux",
  "category": "file_event"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: cdc8c75b4adbc72dcc8e1e5bb5d123fea472c4b811901aacce12e81e8bea7bc2

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Persistence Via Sudoers.d Files
id: ddb26b76-4447-4807-871f-1b035b2bfa5d
status: test
description: |
    Detects the creation or modification of files within the "sudoers.d" directory on Linux systems.
    Such activity may indicate an attempt to establish or maintain privilege escalation by granting specific users elevated permissions.
    Unauthorized changes to sudoers files are a common technique used by attackers to persist administrative access.
references:
    - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/apps/deployer.sh
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-05
modified: 2026-03-18
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1548.003
logsource:
    product: linux
    category: file_event
detection:
    selection:
        TargetFilename|startswith: '/etc/sudoers.d/'
    filter_main_dpkg:
        Image|endswith: '/usr/bin/dpkg'
        TargetFilename: '/etc/sudoers.d/README.dpkg-new'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Creation of legitimate files in sudoers.d folder as part of administrator work
level: medium

Original YAML and metadata in JSON

False positives

• Creation of legitimate files in sudoers.d folder as part of administrator work

Source references

• https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/apps/deployer.sh