Techniques › T1546.017 › AN1056
AN1056 Analytic 1056
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Monitor for creation or modification of udev rules files in key directories (/etc/udev/rules.d/, /lib/udev/rules.d/, /usr/lib/udev/rules.d/). Look for RUN+= or IMPORT keys invoking suspicious binaries or scripts. Correlate this with process execution from systemd-udevd context, and file writes near udev reload/restart events. Combine this with unexpected background process spawning from udevd-related forks.</p>
- Detects
- T1546.017 Udev Rules
- Part of
- DET0375 Detection Strategy for T1546.017 - Udev Rules (Linux)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | chmod, write, create, open | DC0061 File Modification |
| auditd:SYSCALL | execve | DC0032 Process Creation |
| auditd:CONFIG_CHANGE | udev rule reload or trigger command executed | DC0064 Command Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
UdevRulePath | Path to udev rules (may vary by distro or user configuration) |
SuspiciousRunPattern | Regex or string pattern to flag suspicious command executions in RUN+= |
TimeWindow | Max interval between rule change and execution to correlate activity |
ParentProcess | Expected parent of RUN-invoked commands (e.g., systemd-udevd) |