Skip to content
Threat Feed
Subscribe
medium advisory

Monitoring Unauthorized Modifications to Sudoers Configuration

Adversaries may attempt to escalate privileges on Unix-like systems by modifying the sudoers configuration file to grant unauthorized users or groups elevated permissions.

The sudoers file is a critical component of security in Unix-like systems, defining user permissions and the ability to execute commands with elevated privileges. Because this file controls the execution of commands as other users or root, it is a high-value target for adversaries seeking to escalate their privileges or maintain persistent, elevated access. By modifying the sudoers file or its associated files (typically located in /etc/sudoers* or /private/etc/sudoers*), an attacker can grant themselves or a compromised service account unrestricted sudo rights. This activity is a common indicator of a Privilege Escalation (T1548.003) phase in a post-compromise attack chain. Defenders must distinguish these malicious modifications from legitimate changes made by configuration management systems (like Chef or Puppet) or system package managers (like apt/dpkg or yum).

Impact

Successful modification of the sudoers file allows an attacker to achieve full root-level control of the compromised system. This impact includes the ability to bypass security controls, install persistence mechanisms, exfiltrate sensitive data, and move laterally throughout the network with elevated privileges. If not detected, an attacker can maintain long-term, unrestricted access to the host.

Recommendation

  1. Deploy the provided Sigma rule to monitor for unauthorized modifications to sudoers configuration files.
  2. Baseline your environment by identifying and adding internal management tools or unique binary paths to the filter list to minimize false positives.
  3. Ensure that file integrity monitoring is active on all Linux and macOS endpoints for the /etc/ and /private/etc/ directories.
  4. Integrate these alerts into your SIEM's incident response workflow for immediate investigation of any unauthorized write events targeting sudoers.

Immediate actions

Deploy the provided Sigma rule to endpoints.

Detection Engineering 48h

Threat Hunt

Search for recent changes to /etc/sudoers where the modifying process is not an authorized management binary.

T1548.003 high high confidence hunt now

Data: File integrity logs

Mitigations

Review and audit existing sudoers configurations and current access levels.

short_term IT Operations

Privilege escalation via sudo

Detection coverage 1

Detect Unauthorized Modification of Sudoers File

medium

Detects unauthorized creation or modification of sudoers configuration files, excluding known benign administrative and configuration management processes.

sigma tactics: privilege_escalation techniques: T1548.003 sources: file_event, linux

Detection queries are available on the platform. Get full rules →