T1546.017 — Udev Rules

Tactics: Persistence, Privilege Escalation · Platforms: Linux

Adversaries may maintain persistence through executing malicious content triggered using udev rules. Udev is the Linux kernel device manager that dynamically manages device nodes, handles access to pseudo-device files in the `/dev` directory, and responds to hardware events, such as when external…

Sub-technique of Event Triggered Execution (T1546).

Sigma detection rules (1)

T1546.017 Event Triggered Execution: Udev Rules

title: "T1546.017 Event Triggered Execution: Udev Rules"
id: 9cf6988a-7c4d-4f95-8791-e4edcbace494
description: 'Detection Strategy for T1546.017 - Udev Rules (Linux). Expanded to cover all five valid udev rule directories (/etc/udev/rules.d/, /run/udev/rules.d/, /usr/lib/udev/rules.d/, /usr/local/lib/udev/rules.d/, /lib/udev/rules.d/) instead of only /etc/udev/rules.d/, so rule files dropped in any priority-bearing location are caught. Tune using: UdevRulePath, SuspiciousRunPattern, TimeWindow, ParentProcess.'
references:
  - https://attack.mitre.org/techniques/T1546/017
author: Shahrukh Khan
date: 2026-01-19
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1546.017

logsource:
  category: file_change
  product: linux

detection:
  selection:
    type: PATH
    nametype: NORMAL
    name|contains:
      - '/etc/udev/rules.d/'
      - '/run/udev/rules.d/'
      - '/usr/lib/udev/rules.d/'
      - '/usr/local/lib/udev/rules.d/'
      - '/lib/udev/rules.d/'
    name|endswith: '.rules'

  condition: selection

falsepositives:
  - 'Legitimate udev rule additions for custom hardware handling by sysadmins across any of the five rule directories; scope SuspiciousRunPattern to RUN+= directives invoking shell interpreters rather than standard device-permission actions.'
  - 'Package managers installing device driver packages that ship udev rules under /usr/lib/udev/rules.d/ or /lib/udev/rules.d/ as part of normal package installation.'

level: high

Related sub-techniques

Explore