T1546.017sub-technique of T1546 Event Triggered Execution
Udev Rules
Linuxnothing on this site yetT1546.017 on attack.mitre.org
Adversaries may maintain persistence through executing malicious content triggered using udev rules. Udev is the Linux kernel device manager that dynamically manages device nodes, handles access to pseudo-device files in the `/dev` directory, and responds to hardware events, such as when external devices like hard drives or keyboards are plugged in or removed.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
Playbook for this stage
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
how MITRE says to see it
Detection Strategy for T1546.017 - Udev Rules (Linux)
- Monitor for creation or modification of udev rules files in key directories (/etc/udev/rules.d/, /lib/udev/rules.d/, /usr/lib/udev/rules.d/). Look for RUN+= or IMPORT keys invoking suspicious binaries or scripts.
the rest of T1546
- T1546.001 Change Default File Association
- T1546.002 Screensaver
- T1546.003 Windows Management Instrumentation Event Subscription
- T1546.004 Unix Shell Configuration Modification
- T1546.005 Trap
- T1546.006 LC_LOAD_DYLIB Addition
- T1546.007 Netsh Helper DLL
- T1546.008 Accessibility Features
- T1546.009 AppCert DLLs
- T1546.010 AppInit DLLs
- T1546.011 Application Shimming
- T1546.012 Image File Execution Options Injection
- T1546.013 PowerShell Profile
- T1546.014 Emond
- T1546.015 Component Object Model Hijacking
- T1546.016 Installer Packages
- T1546.018 Python Startup Hooks