Abuse Elevation Control Mechanism (T1548)

Tactic: Privilege Escalation · Platforms: Linux, macOS, Windows, IaaS, Office Suite, Identity Provider

The interactive view maps 1 detection strategy, 8 mitigations, 1 threat group, 1 software entry to this technique, alongside D3FEND countermeasures and data-component coverage.

Overview

Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.

Sub-techniques

• Setuid and Setgid (T1548.001)
• Bypass User Account Control (T1548.002)
• Sudo and Sudo Caching (T1548.003)
• Elevated Execution with Prompt (T1548.004)
• Temporary Elevated Cloud Access (T1548.005)
• TCC Manipulation (T1548.006)

Explore

• Open T1548 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1548
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan