MITRE ATT&CK detection coverage

← Back to main site

Home/ MITRE Matrix/ Privilege Escalation/ T1548.003

T1548.003Sudo and Sudo Caching

T1548.003 — Sudo and Sudo Caching is a MITRE ATT&CK technique in the Privilege Escalation tactic. Clankerusecase tracks 41 detection use cases covering it and 4 threat-intel articles citing it.

Privilege Escalation

View on the matrix → Filter Detection Library MITRE official spec ↗

41Use cases

4Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1548 · Abuse Elevation Control Mechanism

Use cases covering this technique (41)

Linux APT Privilege Escalation ESCU actions · hunting P Linux Auditd Doas Conf File Creation ESCU actions · alerting P Linux Auditd Doas Tool Execution ESCU actions · hunting P Linux Auditd Nopasswd Entry In Sudoers File ESCU actions · hunting P Linux Auditd Possible Access To Sudoers File ESCU actions · hunting P Linux Auditd Sudo Or Su Execution ESCU actions · hunting P Linux AWK Privilege Escalation ESCU actions · hunting P Linux Busybox Privilege Escalation ESCU actions · hunting P Linux c89 Privilege Escalation ESCU actions · hunting P Linux c99 Privilege Escalation ESCU actions · hunting P Linux Composer Privilege Escalation ESCU actions · hunting P Linux Cpulimit Privilege Escalation ESCU actions · hunting P Linux Csvtool Privilege Escalation ESCU actions · hunting P Linux Doas Conf File Creation ESCU actions · hunting P Linux Doas Tool Execution ESCU actions · hunting P Linux Emacs Privilege Escalation ESCU actions · hunting P Linux Find Privilege Escalation ESCU actions · hunting P Linux GDB Privilege Escalation ESCU actions · hunting P Linux Gem Privilege Escalation ESCU actions · hunting P Linux GNU Awk Privilege Escalation ESCU actions · hunting P Linux Make Privilege Escalation ESCU actions · hunting P Linux MySQL Privilege Escalation ESCU actions · hunting P Linux Node Privilege Escalation ESCU actions · hunting P Linux NOPASSWD Entry In Sudoers File ESCU actions · hunting P Linux Octave Privilege Escalation ESCU actions · hunting P Linux OpenVPN Privilege Escalation ESCU actions · hunting P Linux PHP Privilege Escalation ESCU actions · hunting P Linux Possible Access To Sudoers File ESCU actions · hunting P Linux Puppet Privilege Escalation ESCU actions · hunting P Linux RPM Privilege Escalation ESCU actions · hunting P Linux Ruby Privilege Escalation ESCU actions · hunting P Linux Sqlite3 Privilege Escalation ESCU actions · hunting P Linux Sudo OR Su Execution ESCU actions · hunting P Linux Sudoers Tmp File Creation ESCU actions · hunting P Linux Visudo Utility Execution ESCU actions · hunting P Linux apt-get Privilege Escalation ESCU actions · hunting P Linux Docker Privilege Escalation ESCU actions · hunting P [LLM] Passwordless root sudoers grant for perfcharts (/etc/sudoers.d/vmware-perf) Bespoke exploit · alerting DSΣPDDCS [LLM] Attacker-controlled sudoers policy written under /etc/sudoers.d (CVE-2026-43760 root file-create primitive) Bespoke install · alerting DSΣPCS [LLM] Passwordless sudo backdoor written for runner account (runner ALL=(ALL) NOPASSWD:ALL) Bespoke install · alerting DSΣPDDCS [LLM] bun runtime executed on CI runner spawning python3 with sudo escalation Bespoke install · alerting DSΣPDDCS

Articles citing this technique (4)

crit Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware art-28

crit Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner art-38

high Mass npm Supply Chain Attack: 20 Leo Platform Packages Compromised art-329

med actions-cool/issues-helper GitHub Action Compromised: All Tags Point to Imposter Commit That Exfiltrates CI/CD Credentials art-472