T1548.003 — Sudo and Sudo Caching

Tactic: Privilege Escalation · Platforms: Linux, macOS

Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges. Within Linux and MacOS systems, sudo (sometimes referred to as "superuser do") allows users to perform…

Sub-technique of Abuse Elevation Control Mechanism (T1548).

Sigma detection rules (2)

T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching

title: "T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
id: 39a4712d-402d-442d-bd64-5577acd51df0
description: 'Behavioral Detection Strategy for Abuse of Sudo and Sudo Caching. The prior version declared logsource category file_change while filtering on type EXECVE, an internally inconsistent combination, and its only condition (sudo -l) is benign permission-listing activity with no relation to the actual abuse this technique describes: manipulating the /var/db/sudo (or /var/lib/sudo on Linux) timestamp cache to bypass re-authentication, or editing /etc/sudoers to disable tty_tickets or add a NOPASSWD entry. Fixed logsource to process_creation for the EXECVE-based signal and added a genuine file_change selection watching /etc/sudoers and the sudo timestamp directory for the tty_tickets/NOPASSWD keywords that actually indicate this abuse. Tune using: timestamp_timeout_threshold, command_allowlist.'
references:
  - https://attack.mitre.org/techniques/T1548/003
author: Shahrukh Khan
date: 2026-03-25
license: MIT
tags:
  - attack.privilege-escalation
  - attack.t1548.003

logsource:
  category: process_creation
  product: linux

detection:
  selection_sudoers_edit:
    type: EXECVE
    a0|endswith:
      - '/sed'
      - '/vi'
      - '/vim'
      - '/echo'
      - '/tee'
  selection_sudoers_target:
    a1|contains: '/etc/sudoers'
  selection_dangerous_directive:
    a2|contains:
      - 'NOPASSWD'
      - '!tty_tickets'
      - 'tty_tickets'
  selection_timestamp_tamper:
    type: PATH
    name|contains:
      - '/var/db/sudo'
      - '/var/lib/sudo'
    nametype:
      - CREATE
      - NORMAL

  condition: (selection_sudoers_edit and selection_sudoers_target and selection_dangerous_directive) or selection_timestamp_tamper

falsepositives:
  - Legitimate sudoers policy changes by administrators via visudo (visudo itself is not matched here since it opens an editor rather than passing content via argv); routine sudo timestamp-cache writes during normal interactive use also touch the timestamp directory, so scope command_allowlist/timestamp_timeout_threshold to unexpected users or off-hours activity.

level: high

T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching

title: "T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
id: a5347c6e-cea2-43c8-9f17-118c3b32fc10
description: 'Behavioral Detection Strategy for Abuse of Sudo and Sudo Caching. (Retargeted to the process_termination macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: admin_user_context, terminal_restart_window.'
references:
  - https://attack.mitre.org/techniques/T1548/003
author: Shahrukh Khan
date: 2026-02-18
license: MIT
tags:
  - attack.privilege-escalation
  - attack.t1548.003

logsource:
  category: process_termination
  product: macos

detection:
  selection:
    Image|endswith: '/sudo'
  condition: selection

falsepositives:
  - Abuse of the sudo credential caching timestamp to run commands without re-prompting for a password looks identical to normal repeated sudo usage within the default timeout window, and process_termination telemetry does not expose the timestamp file state needed to distinguish legitimate reuse from cache abuse.

level: medium

Related sub-techniques

Explore