Sudo and Sudo Caching
Subtechnique · ATTACK:enterprise:T1548.003
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1548.003",
"title": "Sudo and Sudo Caching",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1548/003",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--1365fe3b-0f50-455d-b4da-266ce31c23b0",
"external_id": "T1548.003",
"domain": "enterprise",
"created": "2020-01-30T14:34:44.992Z",
"modified": "2026-05-12T15:12:00.621Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"privilege-escalation"
],
"source_references": [
{
"source_name": "cybereason osx proton",
"url": "https://www.cybereason.com/blog/labs-proton-b-what-this-mac-malware-actually-does"
},
{
"source_name": "OSX.Dok Malware",
"url": "https://blog.malwarebytes.com/threat-analysis/2017/04/new-osx-dok-malware-intercepts-web-traffic/"
},
{
"source_name": "sudo man page 2018",
"url": "https://www.sudo.ws/"
}
]
}Explicit source assertions (13)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1548.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00991be5-e2c2-4645-b743-e9e4af3d38b9
Cobalt Strike Manual 4.3 November 2020ATTACK:enterprise:S9008 → uses → ATTACK:enterprise:T1548.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0fa40749-8520-4270-beba-49afe1b62aae
Socket Shai-Hulud November 2025ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1548.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b9440c0-4993-4d90-bad5-e966981560b7
Aqua Security Blog Trivy Compromise APR 2026ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1548.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3e8662c4-5177-49b3-9674-cb052d269731
CISA_AA25-239ASaltTyphoon_Sept2025ATTACK:enterprise:S0279 → uses → ATTACK:enterprise:T1548.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5408c62f-55e0-4480-8449-ec3c191b66b8
objsee mac malware 2017ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1548.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--800f4061-3347-4816-a633-179ede275505
ATTACK:enterprise:S0281 → uses → ATTACK:enterprise:T1548.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a1ca87ad-0cfc-48e7-a0e4-cee3d81cf917
hexed osx.dok analysis 2019ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1548.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b64060d0-5f39-4163-9f6c-5d944f527ad6
Microsoft Sapphire Sleet APR 2026ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1548.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b69490a4-3768-405e-856d-da11d95183e7
ATTACK:enterprise:T1548.003 → subtechnique-of → ATTACK:enterprise:T1548
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--be444020-9002-42c3-a68c-1591c0d1e9e2
ATTACK:enterprise:S9045 → uses → ATTACK:enterprise:T1548.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f09b6300-73ef-4f9a-8474-f927666142eb
AI-Mexico-Govt-CompromiseATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1548.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f5316001-db89-4c59-8a58-abf12f439c58
ATTACK:enterprise:S9042 → uses → ATTACK:enterprise:T1548.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fb432b6e-dfa2-4974-92f9-b1c6c8058835
Aikido CanisterWorm MAR 2026