Persistence Via Sudoers Files Creation
This rule detects the creation of new files within the `/etc/sudoers.d/` directory. Files in this directory can be used to grant specific users or groups elevated privileges without requiring a password, serving as a persistence mechanism for attackers to maintain privileged access.
Sigma
