Persistence Via Sudoers.d Files (ddb26b76-4447-4807-871f-1b035b2bfa5d)
Detects the creation or modification of files within the "sudoers.d" directory on Linux systems. Such activity may indicate an attempt to establish or maintain privilege escalation by granting specific users elevated permissions. Unauthorized changes to sudoers files are a common technique used by attackers to persist administrative access.