Activity timeline
T1548.003 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-09 with 6 reports, and 24 of the 24 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1548.003 Sudo and Sudo Caching is catalogued by MITRE ATT&CK under the Privilege Escalation tactic in the Enterprise matrix, as a sub-technique of T1548 Abuse Elevation Control Mechanism. Threadlinqs maps 24 of 2623 tracked threats (0.9%) to it; by severity that is 7 critical, 15 high, 2 medium.
Threats that use T1548.003 most often also use T1059.004 Unix Shell (22 threats), T1071.001 Web Protocols (14 threats), T1005 Data from Local System (12 threats), T1082 System Information Discovery (12 threats), T1036.005 Match Legitimate Resource Name or Location (10 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
1 tracked threat actor appear in the threats that use T1548.003; the most frequent are TeamPCP (3).
Mitigations
MITRE ATT&CK lists 3 mitigations for T1548.003.
Data sources
Telemetry that can reveal T1548.003, per MITRE ATT&CK.
- Command — Command Execution
- File — File Modification
- Process — Process Creation, Process Metadata
Threat actors using it
Tracked threats
24 tracked threats use T1548.003.
- CloudSyncD macOS Backdoor Delivered via Fake Zoom Installerhigh
- Mini Shai-Hulud: Compromised @antv npm Packages Steal Developer and CI/CD Credentials (TeamPCP)high
- "LPE Quartet": Public Exploits Released for Four Linux Kernel Local-Root Flaws (DirtyAH6, TUNderflow…high
- Pro-Ukraine 'Hacking Cat' Group Deploys Gorilla RAT, Monkey Ransomware, and Nemo Wiper Against Russian…high
- SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoorcritical
- Multiple Vulnerabilities in Nozomi Guardian/CMC Before 25.4.0 on Siemens RUGGEDCOM APE1808 Devices…high
- Sudo iptables NOPASSWD Misconfiguration Enables Local Privilege Escalation via Comment Injectionmedium
- Hackers Target Zimbra Servers in Active Exploitation Campaign via CVE-2026-73570 SNMP Command Injectioncritical
- CVE-2026-43760: macOS Screen Sharing Logic Flaw Allows VNC-Authenticated Root Command Executioncritical
- AmnesiaStealer: macOS Infostealer Hijacks Live Browser Sessions via Chrome DevTools Protocol Remote Controlhigh
- CVE-2026-65400: macOS Screen Sharing Authentication Bypass Grants Unauthenticated Root Accesscritical
- Microsoft shortens NuGet.org API key lifetimes to 30 days for supply-chain hardening (effective Aug 17, 2026)medium
- SleeperGem: RubyGems Supply Chain Attack Uses Hijacked Dormant Maintainer Accounts to Weaponize…high
- SleeperGem Supply-Chain Campaign Uses Three Malicious RubyGems Packages to Backdoor Developer Machineshigh
- SleeperGem: Compromised RubyGems Packages (git_credential_manager, Dendreo…high
- Bad Epoll (CVE-2026-46242): Use-After-Free Zero-Day in Linux Kernel epoll Subsystem Enables Root Privilege…high
- macOS ClickFix Campaign Silently Mounts Malicious DMGs (hdiutil attach -nobrowse) to Deploy Atomic macOS…high
- Atomic Arch: AUR Package Supply Chain Compromise Using Malicious npm Packagescritical
- Binding.gyp "Phantom Gyp" Supply Chain Attack (Miasma Worm) Enables CI/CD Worm Propagation Across 57 npm…high
- LiteSpeed User-End cPanel Plugin 0-Day CVE-2026-48172 — lsws.redisAble Local Privilege Escalation Exploited…critical
- Nx Console VS Code Extension Backdoored (v18.95.0) — TeamPCP Mini Shai-Hulud Pivot from TanStack npm Worm to…critical
- Fragnesia — DirtyFrag-Family Linux Kernel LPE via XFRM ESP-in-TCP Page-Cache Corruptionhigh
- CVE-2026-31431 "Copy Fail" — Linux Kernel algif_aead Deterministic Local Privilege Escalation Affecting All…high
- Quasar Linux (QLNX) — Sophisticated Linux RAT With LD_PRELOAD Rootkit, PAM Backdoor & DevOps Credential…high
Detection coverage
Threadlinqs maintains 45 detection rules mapped to T1548.003 (SPL 12, KQL 15, Sigma 17, other 1). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1548 Abuse Elevation Control Mechanism — 281 tracked threats at the technique level.