What MITRE ATT&CK T1548.003: Sudo and Sudo Caching (Enterprise Tactic TA0004 - Privilege Escalation / TA0005 - Defense Evasion) requires
MITRE ATT&CK T1548.003 (Sudo and Sudo Caching) is an Enterprise Privilege Escalation and Defense Evasion sub-technique of T1548 (Abuse Elevation Control Mechanism). Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges. Within Linux and MacOS systems, sudo (sometimes referred to as "superuser do") allows users to perform commands from terminals with elevated privileges and to control who can perform these commands on the system. Affected platforms: Linux, macOS. MITRE-documented mitigations include M1022 Restrict File and Directory Permissions, M1028 Operating System Configuration, M1026 Privileged Account Management. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-02, AC-03, AC-05, AC-06, AC-16, CA-07, CM-02, CM-03.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1548/003/
SHA-256 integrity: 776cbdddfed21ed018cc159f2c29cce9d7bfb8a167b4a50f0292c9c6c2e4f5bf
Primary Citations — 7 traced to source
- MITRE ATT&CK Technique T1548.003: Sudo and Sudo Caching (https://attack.mitre.org/techniques/T1548/003/)
- MITRE ATT&CK Tactic TA0004: Privilege Escalation (https://attack.mitre.org/tactics/TA0004/)
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/mitre-attack-t1548-003-sudo-and-sudo-caching.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/mitre-attack-t1548-003-sudo-and-sudo-caching.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/mitre-attack-t1548-003-sudo-and-sudo-caching
- Back to registry: Browse all 10,085 compliance nodes