Detect Udev Rules in IBM QRadar
Adversaries may establish persistence by executing malicious content triggered by udev (userspace /dev) rules. Udev is the Linux kernel device manager that handles device events and dynamic file system creation in /dev. Udev rules files (stored at /etc/udev/rules.d/ and /lib/udev/rules.d/) define actions to execute when devices are connected or disconnected, or when other hardware events occur. Adversaries can create malicious udev rules that execute arbitrary commands — potentially as root — when specific device events occur. Since udev runs as root, any RUN directive in a udev rule executes with root privileges, providing both persistence and privilege escalation.
MITRE ATT&CK
- Tactic
- Persistence Privilege Escalation
- Technique
- T1546 Event Triggered Execution
- Sub-technique
- T1546.017 Udev Rules
- Canonical reference
- https://attack.mitre.org/techniques/T1546/017/
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
logsourcename(logsourceid) AS log_source,
sourceip,
username,
QIDNAME(qid) AS event_name,
CATEGORYNAME(category) AS category_name,
"FILE_PATH",
"FILE_NAME",
"PROCESS_NAME",
"COMMAND",
CASE
WHEN "FILE_PATH" IMATCHES '.*/(etc|lib|usr/lib|run)/udev/rules\.d/.*\.rules.*'
AND "PROCESS_NAME" NOT IMATCHES '.*(apt|dpkg|rpm|yum|dnf|zypper|ansible|puppet|chef|salt).*'
THEN 'Suspicious udev rules write'
WHEN "COMMAND" IMATCHES '.*udevadm.*(trigger|settle|reload|control).*'
AND "PROCESS_NAME" NOT IMATCHES '.*(apt|dpkg|rpm|yum|dnf|zypper|systemd|udev).*'
THEN 'Suspicious udevadm execution'
ELSE 'Unknown'
END AS detection_reason
FROM events
WHERE
LOGSOURCETYPEID IN (
SELECT id FROM logsourcetypes WHERE name ILIKE '%linux%' OR name ILIKE '%syslog%' OR name ILIKE '%auditd%'
)
AND starttime > NOW() - 86400000
AND (
(
"FILE_PATH" IMATCHES '.*/(etc|lib|usr/lib|run)/udev/rules\.d/.*'
AND "FILE_NAME" IMATCHES '.*\.rules'
AND "COMMAND" IMATCHES '.*(wrote|write|create|WRITE|CREATE|open.*O_CREAT|open.*WRONLY).*'
AND "PROCESS_NAME" NOT IMATCHES '.*(apt|dpkg|rpm|yum|dnf|zypper|ansible|puppet|chef|salt).*'
)
OR
(
"COMMAND" IMATCHES '.*udevadm.*(trigger|settle|reload|control).*'
AND "PROCESS_NAME" NOT IMATCHES '.*(apt|dpkg|rpm|yum|dnf|zypper|systemd|udev).*'
)
)
ORDER BY starttime DESCDetects suspicious writes to udev rules directories (/etc/udev/rules.d/, /lib/udev/rules.d/, /usr/lib/udev/rules.d/, /run/udev/rules.d/) or suspicious udevadm invocations (trigger/settle/reload/control) from processes not associated with legitimate package management or configuration management systems. Udev rules execute with root privileges on device events, making them a persistence and privilege escalation vector.
Data Sources
Required Tables
False Positives & Tuning
- System administrators manually writing or modifying udev rules for hardware device management or custom automount configurations
- Package manager operations installing kernel modules, firmware, or hardware drivers that include bundled udev rules files
- Infrastructure automation tools (Ansible, Puppet, Chef) applying device configuration baselines during scheduled maintenance windows
Other platforms for T1546.017
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Malicious Udev Rule for USB Device Persistence
Expected signal: File creation event for /etc/udev/rules.d/99-argus-test.rules. Process creation for tee and udevadm. Auditd records for file creation in /etc/udev/rules.d/. When a USB device is inserted, udevd spawns bash to execute the RUN directive — child process of udevd.
- Test 2Create Udev Rule Triggered by Network Interface
Expected signal: File creation event for 99-argus-net-test.rules in /etc/udev/rules.d/. The rule fires when a network interface is added — logger is spawned by udevd as a child process, creating a syslog entry. Systemd journal shows udevd running the RUN directive.
- Test 3Enumerate All Custom Udev Rules
Expected signal: Process creation for grep, ls with udev directory arguments. Read-only — no modifications. The output reveals all custom rules and their RUN directives.
Unlock Pro Content
Get the full detection package for T1546.017 including response playbook, investigation guide, and atomic red team tests.