T1546.017 Udev Rules Detection — KQL & SPL Queries for Sentinel and Splunk

Microsoft Sentinel / Defender

kusto

DeviceFileEvents
| where Timestamp > ago(24h)
| where (
    FolderPath has "/etc/udev/rules.d/"
    or FolderPath has "/lib/udev/rules.d/"
    or FolderPath has "/usr/lib/udev/rules.d/"
    or FolderPath has "/run/udev/rules.d/"
  )
| where ActionType in ("FileCreated", "FileModified")
| extend FileName_lc = tolower(FileName)
| extend IsRulesFile = FileName endswith ".rules"
| extend IsEtcRules = FolderPath has "/etc/udev/rules.d/"
| extend SuspiciousWriter = InitiatingProcessFileName !in~ (
    "apt", "dpkg", "rpm", "yum", "dnf", "zypper",
    "ansible", "puppet", "chef", "salt-minion"
  )
| project Timestamp, DeviceName, AccountName, ActionType, FileName, FolderPath,
         IsRulesFile, IsEtcRules, SuspiciousWriter,
         InitiatingProcessFileName, InitiatingProcessCommandLine
| where IsRulesFile
| sort by Timestamp desc

high severity medium confidence

Data Sources

File: File Creation File: File Modification Microsoft Defender for Endpoint

Required Tables

DeviceFileEvents

False Positives

Linux package installations (apt, dpkg, rpm, yum) that install device management rules as part of hardware driver or udev rule packages
Configuration management tools (Ansible, Puppet, Chef, Salt) that deploy custom udev rules for device configuration as part of system baseline enforcement
Hardware vendor software that installs udev rules to configure specific hardware devices (e.g., USB security keys, printers, network interfaces)
System administrators manually creating udev rules to manage device permissions or automate device-triggered workflows

Splunk

spl

index=syslog (sourcetype=linux_secure OR sourcetype=syslog)
| eval IsUdevRulesWrite=if(
    match(_raw, "(/etc/udev/rules\.d/|/lib/udev/rules\.d/|/usr/lib/udev/rules\.d/)")
    AND match(_raw, "\.rules")
    AND match(_raw, "(wrote|write|create|WRITE|CREATE|open.*O_CREAT|open.*WRONLY)"),
    1, 0
  )
| eval IsUdevExec=if(
    match(_raw, "udevadm") AND match(_raw, "(trigger|settle|reload|control)"),
    1, 0
  )
| eval SuspiciousWriter=if(
    IsUdevRulesWrite=1
    AND NOT match(_raw, "(apt|dpkg|rpm|yum|dnf|zypper|ansible|puppet|chef|salt)"),
    1, 0
  )
| where IsUdevRulesWrite=1 OR (IsUdevExec=1 AND SuspiciousWriter=1)
| table _time, host, user, _raw, IsUdevRulesWrite, IsUdevExec, SuspiciousWriter
| sort - _time

high severity medium confidence

Data Sources

File: File Modification Linux auditd Syslog

Required Sourcetypes

linux_secure syslog

False Positives

Package managers installing device management rules
Configuration management tools deploying udev rules
Hardware vendor software installing device rules
System administrators manually creating udev rules

Elastic Security (EQL)

eql

any where (
  (
    event.category == "file" and
    event.type in ("creation", "change") and
    (
      file.path like "/etc/udev/rules.d/*" or
      file.path like "/lib/udev/rules.d/*" or
      file.path like "/usr/lib/udev/rules.d/*" or
      file.path like "/run/udev/rules.d/*"
    ) and
    file.name like "*.rules" and
    not process.name in ("apt", "dpkg", "rpm", "yum", "dnf", "zypper", "ansible", "puppet", "chef", "salt-minion")
  ) or
  (
    event.category == "process" and
    event.type == "start" and
    process.name == "udevadm" and
    process.args in ("trigger", "settle", "reload", "control") and
    not process.parent.name in ("apt", "dpkg", "rpm", "yum", "dnf", "zypper", "systemd", "udev")
  )
)

high severity high confidence

Data Sources

Elastic Endpoint Security Auditbeat file integrity monitoring Filebeat auditd module

Required Tables

logs-endpoint.events.file-* logs-endpoint.events.process-* auditbeat-*

False Positives

System administrators manually creating or editing udev rules for legitimate device management (e.g., USB permissions, network interface renaming, udev-based automount rules)
Package managers (apt, dpkg, rpm, yum, dnf) installing hardware support packages that include udev rules (e.g., libusb, udev-extras, firmware packages)
Configuration management tools (Ansible, Puppet, Chef, SaltStack) deploying infrastructure-wide device configuration changes during scheduled runs

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  sourceip,
  username,
  QIDNAME(qid) AS event_name,
  CATEGORYNAME(category) AS category_name,
  "FILE_PATH",
  "FILE_NAME",
  "PROCESS_NAME",
  "COMMAND",
  CASE
    WHEN "FILE_PATH" IMATCHES '.*/(etc|lib|usr/lib|run)/udev/rules\.d/.*\.rules.*'
     AND "PROCESS_NAME" NOT IMATCHES '.*(apt|dpkg|rpm|yum|dnf|zypper|ansible|puppet|chef|salt).*'
    THEN 'Suspicious udev rules write'
    WHEN "COMMAND" IMATCHES '.*udevadm.*(trigger|settle|reload|control).*'
     AND "PROCESS_NAME" NOT IMATCHES '.*(apt|dpkg|rpm|yum|dnf|zypper|systemd|udev).*'
    THEN 'Suspicious udevadm execution'
    ELSE 'Unknown'
  END AS detection_reason
FROM events
WHERE
  LOGSOURCETYPEID IN (
    SELECT id FROM logsourcetypes WHERE name ILIKE '%linux%' OR name ILIKE '%syslog%' OR name ILIKE '%auditd%'
  )
  AND starttime > NOW() - 86400000
  AND (
    (
      "FILE_PATH" IMATCHES '.*/(etc|lib|usr/lib|run)/udev/rules\.d/.*'
      AND "FILE_NAME" IMATCHES '.*\.rules'
      AND "COMMAND" IMATCHES '.*(wrote|write|create|WRITE|CREATE|open.*O_CREAT|open.*WRONLY).*'
      AND "PROCESS_NAME" NOT IMATCHES '.*(apt|dpkg|rpm|yum|dnf|zypper|ansible|puppet|chef|salt).*'
    )
    OR
    (
      "COMMAND" IMATCHES '.*udevadm.*(trigger|settle|reload|control).*'
      AND "PROCESS_NAME" NOT IMATCHES '.*(apt|dpkg|rpm|yum|dnf|zypper|systemd|udev).*'
    )
  )
ORDER BY starttime DESC

high severity medium confidence

Data Sources

Linux Syslog Linux Auditd IBM QRadar Log Source: Linux OS

Required Tables

events

False Positives

System administrators manually writing or modifying udev rules for hardware device management or custom automount configurations
Package manager operations installing kernel modules, firmware, or hardware drivers that include bundled udev rules files
Infrastructure automation tools (Ansible, Puppet, Chef) applying device configuration baselines during scheduled maintenance windows

Sumo Logic CSE

sql

_sourceCategory=linux* OR _sourceCategory=syslog* OR _sourceCategory=auditd*
| parse regex "(?<file_path>/(?:etc|lib|usr/lib|run)/udev/rules\.d/[^\s]+\.rules)" nodrop
| parse regex "(?<process_name>\b(?:apt|dpkg|rpm|yum|dnf|zypper|ansible|puppet|chef|salt-minion|systemd|udevd)\b)" as package_manager nodrop
| parse regex "(?<udevadm_cmd>udevadm\s+(?:trigger|settle|reload|control)[^\n]*)" nodrop
| eval is_udev_rules_write = if (!isNull(file_path) AND ((_raw matches /write|wrote|create|WRITE|CREATE|O_CREAT|WRONLY/)), 1, 0)
| eval is_udev_exec = if (!isNull(udevadm_cmd), 1, 0)
| eval is_package_manager = if (!isNull(package_manager), 1, 0)
| eval suspicious_write = if (is_udev_rules_write == 1 AND is_package_manager == 0, 1, 0)
| eval suspicious_exec = if (is_udev_exec == 1 AND is_package_manager == 0, 1, 0)
| where suspicious_write == 1 OR suspicious_exec == 1
| eval detection_type = if (suspicious_write == 1, "Udev Rules File Write", "Suspicious udevadm Execution")
| fields _messageTime, _sourceHost, _sourceCategory, file_path, udevadm_cmd, detection_type, suspicious_write, suspicious_exec
| sort by _messageTime desc

high severity medium confidence

Data Sources

Linux OS Syslog Auditd logs via Sumo Logic installed collector Sumo Logic CSE Normalized Signals

Required Tables

_sourceCategory=linux* _sourceCategory=syslog* _sourceCategory=auditd*

False Positives

Linux administrators creating udev rules files manually for custom device handling such as persistent network interface naming, USB device permissions, or automount configurations
Software installation via package managers (apt, yum, dnf, rpm) or manual tarballs that write udev rules as part of driver or firmware installation
Infrastructure-as-code deployments using Ansible, Puppet, Chef, or SaltStack applying device configuration changes across a fleet during scheduled runs

Google Chronicle / SecOps

yaral

rule udev_rules_persistence_t1546_017 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects creation or modification of udev rules files by non-package-manager processes, or suspicious udevadm invocations. Adversaries may use udev rules for persistent root-level code execution (T1546.017)."
    mitre_attack_tactic = "Persistence, Privilege Escalation"
    mitre_attack_technique = "T1546.017"
    severity = "HIGH"
    priority = "HIGH"

  events:
    (
      (
        $e.metadata.event_type = "FILE_CREATION" or
        $e.metadata.event_type = "FILE_MODIFICATION"
      ) and
      (
        $e.target.file.full_path = /\/etc\/udev\/rules\.d\/.+\.rules/ or
        $e.target.file.full_path = /\/lib\/udev\/rules\.d\/.+\.rules/ or
        $e.target.file.full_path = /\/usr\/lib\/udev\/rules\.d\/.+\.rules/ or
        $e.target.file.full_path = /\/run\/udev\/rules\.d\/.+\.rules/
      ) and
      not $e.principal.process.file.full_path = /\/(usr\/bin|bin)\/(apt|apt-get|dpkg|rpm|yum|dnf|zypper|ansible|puppet|chef-client|salt-minion)/
    )
    or
    (
      $e.metadata.event_type = "PROCESS_LAUNCH" and
      $e.target.process.file.full_path = /\/.*udevadm/ and
      (
        $e.target.process.command_line = /trigger/ or
        $e.target.process.command_line = /settle/ or
        $e.target.process.command_line = /reload/ or
        $e.target.process.command_line = /control/
      ) and
      not $e.principal.process.file.full_path = /\/(usr\/bin|bin)\/(apt|apt-get|dpkg|rpm|yum|dnf|zypper|systemd|udevd)/
    )

  condition:
    $e
}

high severity high confidence

Data Sources

Google Chronicle UDM Linux endpoint telemetry via Chronicle forwarder GCP Chronicle Security Operations

Required Tables

UDM Events: FILE_CREATION, FILE_MODIFICATION, PROCESS_LAUNCH

False Positives

Legitimate hardware driver or firmware package installation via apt, dpkg, rpm, or yum that writes udev rules as part of device support setup
System administrators or DevOps engineers manually writing udev rules for device naming, permissions, or event-triggered automount configurations
Configuration management automation (Ansible, Puppet, Chef, SaltStack) deploying udev rules as part of approved system configuration baselines

CrowdStrike LogScale (CQL)

cql

// Detect suspicious writes to udev rules directories
(
  #event_simpleName = "PeFileWritten" OR #event_simpleName = "SuspiciousFileWrite"
)
| TargetFileName = /\.(rules)$/
| TargetDirectory = /\/(etc|lib|usr\/lib|run)\/udev\/rules\.d\//
| ImageFileName != /\/(usr\/)?(bin|sbin)\/(apt|apt-get|dpkg|rpm|yum|dnf|zypper|ansible|puppet|chef-client|salt-minion)/
| table([aid, ComputerName, UserName, ImageFileName, CommandLine, TargetFileName, TargetDirectory, @timestamp])

// Union: detect suspicious udevadm invocations
| union
(
  #event_simpleName = "ProcessRollup2"
  | ImageFileName = /\/udevadm$/
  | CommandLine = /(trigger|settle|reload|control)/
  | ParentBaseFileName != /(apt|apt-get|dpkg|rpm|yum|dnf|zypper|systemd|udevd|udev)/
  | table([aid, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, ParentCommandLine, @timestamp])
)
| sort(@timestamp, order=desc)

high severity medium confidence

Data Sources

CrowdStrike Falcon Endpoint Protection Falcon Insight XDR CrowdStrike Falcon Linux sensor

Required Tables

PeFileWritten SuspiciousFileWrite ProcessRollup2

False Positives

Package manager operations (apt, dpkg, yum, rpm, dnf) installing hardware drivers, firmware packages, or kernel modules that include bundled udev rules files
System administrators directly editing udev rules files for legitimate device management tasks such as USB device permissions, persistent network interface naming, or custom device event handlers
Configuration management tools (Ansible, Puppet, Chef, SaltStack) applying device configuration policies across Linux hosts during scheduled infrastructure automation runs

Udev Rules

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Same Tactic: Persistence

Popular Detections