T1548.003sub-technique of T1548 Abuse Elevation Control Mechanism
Sudo and Sudo Caching
Linux · macOSnothing on this site yetT1548.003 on attack.mitre.org
Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges. Within Linux and MacOS systems, sudo (sometimes referred to as "superuser do") allows users to perform commands from terminals with elevated privileges and to control who can perform these commands on the system.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
how MITRE says to see it
Behavioral Detection Strategy for Abuse of Sudo and Sudo Caching
- Correlate command executions involving 'sudo' with elevated effective user ID (euid=0), especially when tty_tickets is disabled or timestamp_timeout is actively abused.
- Detect sudo activity with NOPASSWD in /etc/sudoers or disabling tty_tickets, followed by immediate privileged commands (e.g., echo 'Defaults !tty_tickets' >> /etc/sudoers).
what reduces it
- M1028 Operating System Configuration. Ensuring that the `tty_tickets` setting is enabled will prevent this leakage across tty sessions.
- M1022 Restrict File and Directory Permissions. The sudoers file should be strictly edited such that passwords are always required and that users can't spawn risky processes as users with higher privilege.
- M1026 Privileged Account Management. By requiring a password, even if an adversary can get terminal access, they must know the password to run anything in the sudoers file. Setting the `timestamp_timeout` to 0 will require the user to input their password every time `sudo` is executed.