t1546-017-udev-rules

name	T1546.017_udev-rules
description	Adversaries may maintain persistence through executing malicious content triggered using udev rules.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1546.017","persistence","privilege-escalation","linux","sub-technique"]
technique_id	T1546.017
tactic	persistence
all_tactics	["persistence","privilege-escalation"]
platforms	["Linux"]
mitre_url	https://attack.mitre.org/techniques/T1546/017
tech_stack	["linux"]
cwe_ids	["CWE-276"]
chains_with	["T1546","T1546.001","T1546.002","T1546.003","T1546.004","T1546.005","T1546.006","T1546.007","T1546.008","T1546.009","T1546.010","T1546.011","T1546.012","T1546.013","T1546.014","T1546.015","T1546.016","T1546.018"]
prerequisites	["T1546"]
severity_boost	{"T1546":"Chain with T1546 for deeper attack path","T1546.001":"Chain with T1546.001 for deeper attack path","T1546.002":"Chain with T1546.002 for deeper attack path"}

T1546.017 Udev Rules

Sub-technique of: T1546

High-Level Description

Adversaries may maintain persistence through executing malicious content triggered using udev rules. Udev is the Linux kernel device manager that dynamically manages device nodes, handles access to pseudo-device files in the /dev directory, and responds to hardware events, such as when external devices like hard drives or keyboards are plugged in or removed. Udev uses rule files with match keys to specify the conditions a hardware event must meet and action keys to define the actions that should follow. Root permissions are required to create, modify, or delete rule files located in /etc/udev/rules.d/, /run/udev/rules.d/, /usr/lib/udev/rules.d/, /usr/local/lib/udev/rules.d/, and /lib/udev/rules.d/. Rule priority is determined by both directory and by the digit prefix in the rule filename.

Adversaries may abuse the udev subsystem by adding or modifying rules in udev rule files to execute malicious content. For example, an adversary may configure a rule to execute their binary each time the pseudo-device file, such as /dev/random, is accessed by an application. Although udev is limited to running short tasks and is restricted by systemd-udevd's sandbox (blocking network and filesystem access), attackers may use scripting commands under the action key RUN+= to detach and run the malicious content’s process in the background to bypass these controls.

Kill Chain Phase

• Persistence (TA0003)
• Privilege Escalation (TA0004)

Platforms: Linux

What to Check

• Identify if Udev Rules technique is applicable to target environment
• Check Linux systems for indicators of Udev Rules
• Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

1. Identify Attack Surface: Determine if the target environment is susceptible to Udev Rules by examining the target platforms (Linux).

2. Assess Existing Defenses: Review whether mitigations for T1546.017 are in place. If defenses are absent or misconfigured, this technique may be exploitable.