So they check .bash_history and then they realize they just need to also `alias /usr/bin/sudo`.

> So they check .bash_history and then they realize they just need to also `alias /usr/bin/sudo`.

    $ alias /usr/bin/sudo=whatever
    bash: alias: `/usr/bin/sudo': invalid alias name

Oh, fair point. Not all shells support this apparently. zsh does:

    -> alias /usr/bin/sudo='ls -a'
    -> /usr/bin/sudo
     .  ..

Hm. How about ‘sudo’ <> ? i.e. quote the command?

If they have access to your .bashrc they can also alter your PATH and create a script named sudo somewhere they have write access to that carries the malicious payload. So you're not gaining much by adding the quotes.

Based on the sibling comment to yours, I don't think bash supports this. zsh allows you to make a \'sudo\' alias though, so it depends on your shell.

At least in bash, quoting the command disables any alias. Maybe also in zsh?

zsh seems to have much more flexible alias rules than bash:

    > alias \'sudo\'='ls -a'
    > 'sudo'                
    .  ..