Detection of Privilege Escalation via Unauthorized Sudoers Modification

Adversaries targeting Linux and macOS environments frequently attempt to achieve persistent privilege escalation by manipulating system configuration files. A common technique involves modifying the /etc/sudoers file to grant specific users or groups passwordless sudo access. By leveraging the echo command, an attacker can append a line containing the NOPASSWD: ALL directive to the sudoers file or a file within the sudoers.d directory. This configuration change effectively bypasses authentication requirements for elevated operations, granting the attacker persistent root-level command execution capabilities. Defenders should monitor for suspicious execution patterns involving the echo utility directed toward sensitive system configuration files.

Attack Chain

1. Attacker gains initial user-level access on a Linux or macOS system.
2. Attacker identifies a target user account or group for privilege escalation.
3. Attacker uses the echo command to craft a line containing the NOPASSWD: ALL configuration directive.
4. Attacker redirects or appends the output of the echo command into the /etc/sudoers file or a file located in /etc/sudoers.d/.
5. The system configuration is updated, granting the specified user unrestricted, passwordless sudo privileges.
6. Attacker executes a command via sudo to confirm the bypass of authentication prompts.
7. Attacker proceeds to perform further post-exploitation activities, such as exfiltration or lateral movement, with elevated permissions.

Impact

Successful exploitation allows unauthorized users to execute commands with root privileges without providing a password. This enables complete system compromise, persistent backdoor creation, and potential lateral movement across the internal network.

Recommendation

Deploy the Sigma rule provided in this brief to detect suspicious sudoers modifications. Audit current /etc/sudoers and /etc/sudoers.d/ configurations to ensure only authorized users have elevated access. Implement rigorous logging of modifications to critical system files using tools like auditd or file integrity monitoring (FIM) solutions.