CanisterWormS9042 ↗
Has checked if the current user is root. If it is, CanisterWorm will wipe the system using rm –rf / --no-preserve-root. If it is not, CanisterWorm will try passwordless sudo and will run the same command.1
tfMITRE ATT&CK sub-technique
Sudo and Sudo Caching T1548.003
sub-technique of T1548 Abuse Elevation Control Mechanism
- Tactic
- Privilege Escalation
- Platforms
- Linux, macOS
- Version
- 2.0
- Created
- 30 January 2020
- Last modified
- 12 May 2026
Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.6
Tools & malware68th pct
Tools & malware68th percentile · 68% of ATT&CK techniques have this many tools implementing them or fewer.38
Detection rulesTop 6%
Detection rules94th percentile · 94% of ATT&CK techniques have this many detection rules written or fewer.Sudo and Sudo Caching MITRE reference T1548.003
68th pctamong all ATT&CK techniques for number of tools
6 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
TeamPCP Cloud StealerS9041 ↗
Can use sudo for code execution.1
Shai-HuludS9008 ↗
Has attempted to gain root access by leveraging sudo and /etc/sudoers.d.1
DokS0281 ↗
Adds admin ALL=(ALL) NOPASSWD: ALL to the /etc/sudoers file.1
ProtonS0279 ↗
Modifies the tty_tickets line in the sudoers file.1
Cobalt StrikeS0154 ↗
Can use sudo to run a command.1
All 6 software entries for this technique
Offense vs defense T1548.003
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 35
first rule: 2019 Q4Sudo and Sudo Caching detection strategy DET0052
MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection Strategy for Abuse of Sudo and Sudo Caching
2 platforms
AN0142 · Linux
Correlate command executions involving 'sudo' with elevated effective user ID (euid=0), especially when tty_tickets is disabled or timestamp_timeout is actively abused.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process MetadataDC0034 | auditd:SYSCALL | execve call for sudo where euid != uid |
| File ModificationDC0061 | auditd:SYSCALL | execve call for modification of /etc/sudoers or writing to /var/db/sudo |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| timestamp_timeout_threshold | Tune the valid sudo session duration to reduce false positives |
| command_allowlist | Filter benign sudo usage (e.g., approved admin scripts) |
AN0143 · macOS
Detect sudo activity with NOPASSWD in /etc/sudoers or disabling tty_tickets, followed by immediate privileged commands (e.g., echo 'Defaults !tty_tickets' >> /etc/sudoers).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process TerminationDC0033 | macos:unifiedlog | Terminal process killed (killall Terminal) immediately after sudoers modification |
| Command ExecutionDC0064 | macos:unifiedlog | exec or sudo usage with NOPASSWD context or echo modifying sudoers |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| admin_user_context | Define allowed users who may modify sudoers without investigation |
| terminal_restart_window | Time window after sudoers file change to monitor for Terminal restarts |
Ensuring that the tty_tickets setting is enabled will prevent this leakage across tty sessions.
By requiring a password, even if an adversary can get terminal access, they must know the password to run anything in the sudoers file. Setting the timestamp_timeout to 0 will require the user to input their password every time sudo is executed.
The sudoers file should be strictly edited such that passwords are always required and that users can't spawn risky processes as users with higher privilege.
Tests6Executorssh 6Need elevation6 of 6Have prerequisites3Have cleanup0Platformsmacos, linux
Tests from Atomic Red Team (MIT licence) · technique definition