T1548.003Privilege Escalation
Sudo and Sudo Caching
Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges. Within Linux and MacOS systems, sudo (sometimes referred to as "superuser do") allows users to perform commands from terminals with elevated privileges and to control who can perform these commands on the…
CVEs1
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
3 Sigma rules tagged T1548.003Sudo and Sudo CachingT1548.0033 general rules
- Sudo Privilege Escalation CVE-2019-14287 - Builtincriticaltest
- Sudo Privilege Escalation CVE-2019-14287hightest
- Persistence Via Sudoers Filesmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Sudo and Sudo Caching
1 CVE, by priority. Each link shows its badge.- CVE-2018-15767Improper Authorization VulnerabilityMITRE CTID mapping of the CVE · primary impact12.3%Top 3.8%24.2priority