Sudo Caching and Elevation Abuse

Danny Y@zendannyy

•updated Jun 3, 2026•2•0•9

Detects attempts to abuse sudo and sudo caching mechanisms by modifying the /etc/sudoers file to disable tty_tickets, add NOPASSWD entries. This behavior is associated with malware like Proton and Dok to escalate privileges.