Linux Sudoers File Modification for Persistence and Privilege Escalation

Adversaries targeting Linux environments often seek to gain and maintain elevated privileges by modifying the sudoers configuration files. The sudoers file, located at /etc/sudoers, and the directory /etc/sudoers.d/ control user access to the sudo command. By injecting custom configuration lines, an attacker can grant their user account passwordless root execution, essentially providing a persistent backdoor with administrative access. This technique is observed in various malware kits, such as the TripleCross rootkit, which utilizes modification of these files to ensure persistence. Defenders must distinguish between authorized changes made by configuration management tools (like Ansible or Chef) or system package updates and unauthorized modifications that indicate malicious intent.

Attack Chain

1. Attacker gains initial access to a Linux system via an exploit or stolen credentials.
2. Attacker enumerates current user privileges and sudoers configuration files.
3. Attacker identifies the target sudoers file or a sub-file within /etc/sudoers.d/ for modification.
4. Attacker writes malicious configuration strings (e.g., "user ALL=(ALL) NOPASSWD: ALL") to the target file.
5. Attacker leverages file integrity monitoring or system tools to persist changes.
6. Attacker executes commands using sudo without needing to provide a password.
7. Final objective is achieved, such as long-term persistence or data exfiltration as root.

Impact

Successful modification of sudoers files results in complete system compromise, allowing an attacker to maintain persistent, passwordless administrative access. This enables full control over the host, potential lateral movement, and unmonitored exfiltration of sensitive data.

Recommendation

• Deploy the provided Sigma rule to monitor file modifications to /etc/sudoers and the /etc/sudoers.d/ directory.
• Establish a baseline for authorized configuration management tools (e.g., SaltStack, Puppet, Ansible) that legitimately modify these files to reduce false positives.
• Audit existing sudoers configuration files for unauthorized "NOPASSWD" directives or unfamiliar user entries.
• Enable file integrity monitoring (FIM) on /etc/sudoers and /etc/sudoers.d/ to alert on any changes in real-time.