---
attack_technique: T1548.003
display_name: "Abuse Elevation Control Mechanism: Sudo and Sudo Caching"

atomic_tests:
- name: Sudo usage
  auto_generated_guid: 150c3a08-ee6e-48a6-aeaf-3659d24ceb4e
  description: |
    Common Sudo enumeration methods.

  supported_platforms:
    - macos
    - linux

  executor:
    name: sh
    elevation_required: true
    command: |
      sudo -l      
      sudo cat /etc/sudoers
      sudo vim /etc/sudoers

- name: Unlimited sudo cache timeout
  auto_generated_guid: a7b17659-dd5e-46f7-b7d1-e6792c91d0bc
  description: |
    Sets sudo caching timestamp_timeout to a value for unlimited. This is dangerous to modify without using 'visudo', do not do this on a production system.

  supported_platforms:
    - macos
    - linux

  executor:
    name: sh
    elevation_required: true
    command: |
      sudo sed -i 's/env_reset.*$/env_reset,timestamp_timeout=-1/' /etc/sudoers
      sudo visudo -c -f /etc/sudoers

- name: Disable tty_tickets for sudo caching
  auto_generated_guid: 91a60b03-fb75-4d24-a42e-2eb8956e8de1
  description: |
    Sets sudo caching tty_tickets value to disabled. This is dangerous to modify without using 'visudo', do not do this on a production system.

  supported_platforms:
    - macos
    - linux

  executor:
    name: sh
    elevation_required: true
    command: |
      sudo sh -c "echo Defaults "'!'"tty_tickets >> /etc/sudoers"
      sudo visudo -c -f /etc/sudoers