Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1548.003

Sudo and Sudo Caching

Privilege Escalation 58 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
elastic Excessive Sudo Authentication Failures via macOS Security Events production 2026-10-06
elastic Potential Sudo Token Manipulation via Process Injection production 2026-09-18
elastic Potential Sudo Hijacking production 2026-09-18
elastic Potential CVE-2025-32463 Sudo Chroot Execution Attempt production 2026-09-18
elastic Potential Sudo Privilege Escalation via CVE-2019-14287 production 2026-09-18
elastic Suspicious SUID Binary Execution (Auditd Sequence) production 2026-09-18
elastic Suspicious SUID Binary Execution production 2026-09-18
elastic Potential Privilege Escalation via Sudoers File Modification production 2026-09-18
elastic Sudoers File Activity production 2026-09-18
elastic Modification of Persistence Relevant Files Detected via Defend for Containers production 2026-09-18
elastic Suspicious Echo or Printf Execution Detected via Defend for Containers production 2026-09-18
elastic Potential Persistence via File Modification production 2026-09-18
elastic Potential Defense Evasion via Doas production 2026-09-18
elastic Sudo Command Enumeration Detected production 2026-09-18
elastic Pod or Container Creation with Suspicious Command-Line production 2026-09-18
elastic Potential Suspicious File Edit production 2026-09-18
sigma Persistence Via Sudoers Files test 2026-08-15
elastic Deprecated - Sudo Heap-Based Buffer Overflow Attempt deprecated 2026-07-02
splunk Linux GDB Privilege Escalation production 2026-05-13
splunk Linux Gem Privilege Escalation production 2026-05-13
splunk Linux GNU Awk Privilege Escalation production 2026-05-13
splunk Linux Make Privilege Escalation production 2026-05-13
splunk Linux MySQL Privilege Escalation production 2026-05-13
splunk Linux Node Privilege Escalation production 2026-05-13
splunk Linux NOPASSWD Entry In Sudoers File production 2026-05-13
splunk Linux Octave Privilege Escalation production 2026-05-13
splunk Linux OpenVPN Privilege Escalation production 2026-05-13
splunk Linux PHP Privilege Escalation production 2026-05-13
splunk Linux Possible Access To Sudoers File production 2026-05-13
splunk Linux Puppet Privilege Escalation production 2026-05-13
splunk Linux RPM Privilege Escalation production 2026-05-13
splunk Linux Sqlite3 Privilege Escalation production 2026-05-13
splunk Linux Sudo OR Su Execution production 2026-05-13
splunk Linux Sudoers Tmp File Creation production 2026-05-13
splunk Linux Visudo Utility Execution production 2026-05-13
splunk Linux Ruby Privilege Escalation production 2026-05-13
splunk Linux APT Privilege Escalation production 2026-05-13
splunk Linux Auditd Doas Conf File Creation production 2026-05-13
splunk Linux Auditd Doas Tool Execution production 2026-05-13
splunk Linux Auditd Nopasswd Entry In Sudoers File production 2026-05-13
splunk Linux Auditd Possible Access To Sudoers File production 2026-05-13
splunk Linux Auditd Sudo Or Su Execution production 2026-05-13
splunk Linux AWK Privilege Escalation production 2026-05-13
splunk Linux Busybox Privilege Escalation production 2026-05-13
splunk Linux c89 Privilege Escalation production 2026-05-13
splunk Linux c99 Privilege Escalation production 2026-05-13
splunk Linux Composer Privilege Escalation production 2026-05-13
splunk Linux Cpulimit Privilege Escalation production 2026-05-13
splunk Linux Csvtool Privilege Escalation production 2026-05-13
splunk Linux Doas Conf File Creation production 2026-05-13
splunk Linux Doas Tool Execution production 2026-05-13
splunk Linux Emacs Privilege Escalation production 2026-05-13
splunk Linux Find Privilege Escalation production 2026-05-13
elastic Deprecated - Network Connection via Sudo Binary deprecated 2026-02-04
elastic Deprecated - Suspicious File Creation in /etc for Persistence deprecated 2025-06-26
elastic Suspicious Network Connection Attempt by Root deprecated 2023-07-31
sigma Sudo Privilege Escalation CVE-2019-14287 - Builtin test 2022-11-26
sigma Sudo Privilege Escalation CVE-2019-14287 test 2022-10-05