CmdID

CmdID / Techniques / T1548

T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching

Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. MITRE ATT&CK

1 Sigma rule T1548.003 on attack.mitre.org

Part of

MITRE ATT&CK
T1548Abuse Elevation Control Mechanism

Sigma rules tagged with it

process creation, the highest levels first
highSudo Privilege Escalation CVE-2019-14287Florian Roth (Nextron Systems) · Linux

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

edit the crontab file for a specific user on the page for crontab

sudo crontab -e -u userIdentify

Generate completions for Bash on the page for pueue-completions

sudo pueue completions bash /usr/share/bash-completion/completions/pueue.bashIdentify

Generate completions for Zsh on the page for pueue-completions

sudo pueue completions zsh /usr/share/zsh/site-functionsIdentify

Specify a shell for running instead of the default shell (also works for login) on the page for runuser

sudo runuser user --shell /bin/shIdentify

Overlay a unit file non-destructively on the page for systemctl-edit

sudo systemctl edit unit_fileIdentify

Edit a unit file on the page for systemctl-edit

sudo systemctl edit unit_file --fullIdentify

Create a new unit file on the page for systemctl-edit

sudo systemctl edit unit_file --full --forceIdentify

An example is here when CmdID’s reading of it names T1548.003: a Sigma rule it trips is tagged with it, or its abuse is documented as it.