T1548: Abuse Elevation Control Mechanism
| View on MITRE ATT&CK | T1548 |
|---|---|
| Tactic(s) | Privilege Escalation, Defense Evasion |
| Associated CAPEC Patterns | Authentication Abuse (CAPEC-114) , Privilege Escalation (CAPEC-233) , Authentication Bypass (CAPEC-115) , Privilege Abuse (CAPEC-122) |
Data from MITRE ATT&CK®:
Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
© 2024 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Cyber Threat Graph Context
Explore how this ATT&CK Technique relates to the wider threat graph
Mitigations for this technique
MITRE ATT&CK Mitigations
Restrict File and Directory Permissions
Restrict access by setting directory and file permissions that are not specific to users or privileged accounts.Execution Prevention
Block execution of code on a system through application control, and/or script blocking.Operating System Configuration
Make configuration changes related to the operating system or a common feature of the operating system that result in system hardening against techniques.User Account Control
Configure Windows User Account Control to mitigate risk of adversaries obtaining elevated process access.Audit
Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.Privileged Account Management
Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root.User Account Management
Manage the creation, modification, use, and permissions associated to user accounts.How to detect this technique
MITRE ATT&CK Data Components
Windows Registry Key Modification (Windows Registry)
Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)Command Execution (Command)
The execution of a line of text, potentially with arguments, created from program code (e.g. a cmdlet executed via powershell.exe, interactive commands like >dir, shell executions, etc. )OS API Execution (Process)
Operating system function/method calls executed by a processProcess Creation (Process)
The initial construction of an executable managed by the OS, that may involve one or more tasks or threads. (e.g. Win EID 4688, Sysmon EID 1, cmd.exe > net use, etc.)File Modification (File)
Changes made to a file, or its access permissions and attributes, typically to alter the contents of the targeted file (ex: Windows EID 4670 or Sysmon EID 2)File Metadata (File)
Contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/owner, permissions, etc.User Account Modification (User Account)
Changes made to an account, such as permissions and/or membership in specific groups (ex: Windows EID 4738 or /var/log access/authentication logs)Process Metadata (Process)
Contextual data about a running process, which may include information such as environment variables, image name, user/owner, etc.Sigma Detections for this Technique
AWS STS AssumeRole Misuse
Linux Doas Tool Execution
New CA Policy by Non-approved Actor
UAC Bypass via Windows Firewall Snap-In Hijack
CA Policy Updated by Non Approved Actor
Regedit as Trusted Installer
SCM Database Privileged Operation
AWS STS GetSessionToken Misuse
User Added To Group With CA Policy Modification Access
Vulnerable Netlogon Secure Channel Connection Allowed
AWS Suspicious SAML Activity
User Removed From Group With CA Policy Modification Access
COM Hijack via Sdclt
CA Policy Removed by Non Approved Actor
Credential Dumping Attempt Via Svchost
Abused Debug Privilege by Arbitrary Parent Processes
Linux Capabilities Discovery
GCP Break-glass Container Workload Deployed
Linux Doas Conf File Creation
SP800-53 Controls
See which controls can help protect against this MITRE ATT&CK technique. This is based on mappings to associated SP800-53 controls produced by the MITRE Engenuity Center for Threat-Informed Defense.