Udev Rules abuse (MITRE ATT&CK T1546.017) is a Linux persistence technique. Udev is the kernel device manager. It manages device nodes, handles access to pseudo-device files in /dev and responds to hardware events, such as plugging in or removing a drive or keyboard.
How attackers use it
Udev rules have match keys, which say what conditions an event must meet, and action keys, which say what follows. Rule files live in these directories, and creating, changing or deleting them requires root:
/etc/udev/rules.d//run/udev/rules.d//usr/lib/udev/rules.d//usr/local/lib/udev/rules.d//lib/udev/rules.d/
Priority depends on both the directory and the digit prefix in the file name.
MITRE gives an example: a rule that executes an adversary binary each time an application accesses a pseudo-device file such as /dev/random. Udev is meant for short tasks and systemd-udevd runs in a sandbox that blocks network and filesystem access. MITRE says attackers may use scripting commands under the RUN+= action key to detach and run the content in the background, which gets around those limits.
How to detect it
MITRE's strategy combines several signals:
- Creation or modification of rule files in the directories above.
RUN+=orIMPORTkeys that invoke suspicious binaries or scripts.- Process execution in the systemd-udevd context, and file writes close to udev reload or restart events.
- Unexpected background processes spawned from udevd related forks.
Auditd file watches on the rule directories give you the first signal cheaply.
How to reduce the risk
MITRE lists no mitigations for this technique. Because writing rules needs root, the controls are privileged account hygiene, file integrity monitoring on the rule directories and keeping the rule set small and reviewed.
Check your own environment
Read-only commands on Linux:
ls -la /etc/udev/rules.d/
grep -rn 'RUN+=' /etc/udev/rules.d/ /usr/lib/udev/rules.d/ /lib/udev/rules.d/
Most RUN entries belong to the distribution or to known software. Investigate any that point to a path in /tmp, a home directory or a shell with a detach pattern.
An auditd watch rule example for monitoring writes, in a rules file:
-w /etc/udev/rules.d/ -p wa -k udev_rules
Quick check
Why does udev persistence need root?
Creating, modifying or deleting rule files in the udev directories requires root permissions, so it signals a privileged compromise already in progress.
