Suspicious Udev driver rule execution manipulation

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules
Detector Tags
ATT&CK Tactic	Persistence (TA0003) Privilege Escalation (TA0004)
ATT&CK Technique	Boot or Logon Autostart Execution: Kernel Modules and Extensions (T1547.006)
Severity	Low

Udev driver rule was modified with unusual pattern, might be used by adversaries to backdoor existing drivers.

Adversaries can use this technique to execute arbitrary commands once the machine boots.

Check if the action was done using an automation service.
Check the rule modification content and look for any suspicious payloads.
Check if there are any other suspicious activities originated from the same machine/executing user.

ATT&CK Tactic

ATT&CK Technique

Severity

Low

Udev driver rule was modified with unusual pattern, might be used by adversaries to backdoor existing drivers.

Adversaries can use this technique to execute arbitrary commands once the machine boots.

Check if the action was done using an automation service.
Check the rule modification content and look for any suspicious payloads.
Check if there are any other suspicious activities originated from the same machine/executing user.