Abuse Elevation Control Mechanism

T1548

Technique with 6 sub-techniques.View on attack.mitre.org

About this technique

Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.

Detection rules153

Rules on DetectionCode tagged with T1548 or one of its sub-techniques.

Sigma84

Rule	Level	Log source	Technique
HackTool - Empire PowerShell UAC Bypass	critical	windows / process_creation	T1548.002
Sudo Privilege Escalation CVE-2019-14287 - Builtin	critical	linux / NULL	T1548.003
TrustedPath UAC Bypass Pattern	critical	windows / process_creation	T1548.002
Abused Debug Privilege by Arbitrary Parent Processes	high	windows / process_creation	T1548
Bypass UAC Using DelegateExecute	high	windows / registry_set	T1548.002
Bypass UAC Using SilentCleanup Task	high	windows / registry_set	T1548.002
Bypass UAC via CMSTP	high	windows / process_creation	T1548.002
Bypass UAC via Fodhelper.exe	high	windows / process_creation	T1548.002
Bypass UAC via WSReset.exe	high	windows / process_creation	T1548.002
CMSTP UAC Bypass via COM Object Access	high	windows / process_creation	T1548.002
COM Hijack via Sdclt	high	windows / registry_set	T1548
Credential Dumping Attempt Via Svchost	high	windows / process_access	T1548
Explorer NOUACCHECK Flag	high	windows / process_creation	T1548.002
HackTool - UACMe Akagi Execution	high	windows / process_creation	T1548.002
HackTool - WinPwn Execution	high	windows / process_creation	T1548.002
HackTool - WinPwn Execution - ScriptBlock	high	windows / ps_script	T1548.002
Potential Privilege Escalation via Local Kerberos Relay over LDAP	high	windows / NULL	T1548
Potentially Suspicious Event Viewer Child Process	high	windows / process_creation	T1548.002
PowerShell Web Access Feature Enabled Via DISM	high	windows / process_creation	T1548.002
PwnKit Local Privilege Escalation	high	linux / NULL	T1548.001
Regedit as Trusted Installer	high	windows / process_creation	T1548
Registry Hive File Staged Outside Standard User Profile Path	high	windows / file_event	T1548
Shell Open Registry Keys Manipulation	high	windows / registry_event	T1548.002
Sudo Privilege Escalation CVE-2019-14287	high	linux / process_creation	T1548.003
Trusted Path Bypass via Windows Directory Spoofing	high	windows / image_load	T1548.002
UAC Bypass Abusing Winsat Path Parsing - File	high	windows / file_event	T1548.002
UAC Bypass Abusing Winsat Path Parsing - Process	high	windows / process_creation	T1548.002
UAC Bypass Abusing Winsat Path Parsing - Registry	high	windows / registry_set	T1548.002
UAC Bypass Tools Using ComputerDefaults	high	windows / process_creation	T1548.002
UAC Bypass Using .NET Code Profiler on MMC	high	windows / file_event	T1548.002
UAC Bypass Using ChangePK and SLUI	high	windows / process_creation	T1548.002
UAC Bypass Using Consent and Comctl32 - File	high	windows / file_event	T1548.002
UAC Bypass Using Consent and Comctl32 - Process	high	windows / process_creation	T1548.002
UAC Bypass Using Disk Cleanup	high	windows / process_creation	T1548.002
UAC Bypass Using DismHost	high	windows / process_creation	T1548.002
UAC Bypass Using IDiagnostic Profile	high	windows / process_creation	T1548.002
UAC Bypass Using IDiagnostic Profile - File	high	windows / file_event	T1548.002
UAC Bypass Using IEInstal - File	high	windows / file_event	T1548.002
UAC Bypass Using IEInstal - Process	high	windows / process_creation	T1548.002
UAC Bypass Using Iscsicpl - ImageLoad	high	windows / image_load	T1548.002
UAC Bypass Using MSConfig Token Modification - File	high	windows / file_event	T1548.002
UAC Bypass Using MSConfig Token Modification - Process	high	windows / process_creation	T1548.002
UAC Bypass Using NTFS Reparse Point - File	high	windows / file_event	T1548.002
UAC Bypass Using NTFS Reparse Point - Process	high	windows / process_creation	T1548.002
UAC Bypass Using PkgMgr and DISM	high	windows / process_creation	T1548.002
UAC Bypass Using Windows Media Player - File	high	windows / file_event	T1548.002
UAC Bypass Using Windows Media Player - Process	high	windows / process_creation	T1548.002
UAC Bypass Using Windows Media Player - Registry	high	windows / registry_set	T1548.002
UAC Bypass Using WOW64 Logger DLL Hijack	high	windows / process_access	T1548.002
UAC Bypass via Event Viewer	high	windows / registry_set	T1548.002
UAC Bypass via ICMLuaUtil	high	windows / process_creation	T1548.002
UAC Bypass via Sdclt	high	windows / registry_set	T1548.002
UAC Bypass Via Wsreset	high	windows / registry_event	T1548.002
UAC Bypass With Fake DLL	high	windows / image_load	T1548.002
UAC Bypass WSReset	high	windows / process_creation	T1548.002
Vulnerable Netlogon Secure Channel Connection Allowed	high	windows / NULL	T1548
Always Install Elevated MSI Spawned Cmd And Powershell	medium	windows / process_creation	T1548.002
Always Install Elevated Windows Installer	medium	windows / process_creation	T1548.002
AWS Suspicious SAML Activity	medium	aws / NULL	T1548
CA Policy Removed by Non Approved Actor	medium	azure / NULL	T1548
CA Policy Updated by Non Approved Actor	medium	azure / NULL	T1548
Function Call From Undocumented COM Interface EditionUpgradeManager	medium	windows / process_access	T1548.002
GCP Break-glass Container Workload Deployed	medium	gcp / NULL	T1548
Linux Doas Conf File Creation	medium	linux / file_event	T1548
New CA Policy by Non-approved Actor	medium	azure / NULL	T1548
Persistence Via Sudoers Files	medium	linux / file_event	T1548.003
Potential UAC Bypass Via Sdclt.EXE	medium	windows / process_creation	T1548.002
Registry Modification of MS-settings Protocol Handler	medium	windows / process_creation	T1548.002
SCM Database Privileged Operation	medium	windows / NULL	T1548
Sdclt Child Processes	medium	windows / process_creation	T1548.002
Suspicious Shell Open Command Registry Modification	medium	windows / registry_set	T1548.002
UAC Bypass via Windows Firewall Snap-In Hijack	medium	windows / process_creation	T1548
UAC Disabled	medium	windows / registry_set	T1548.002
UAC Notification Disabled	medium	windows / registry_set	T1548.002
UAC Secure Desktop Prompt Disabled	medium	windows / registry_set	T1548.002
User Added To Group With CA Policy Modification Access	medium	azure / NULL	T1548
User Removed From Group With CA Policy Modification Access	medium	azure / NULL	T1548
AWS STS AssumeRole Misuse	low	aws / NULL	T1548
AWS STS GetSessionToken Misuse	low	aws / NULL	T1548
Linux Capabilities Discovery	low	linux / NULL	T1548
Linux Doas Tool Execution	low	linux / process_creation	T1548
Linux Setgid Capability Set on a Binary via Setcap Utility	low	linux / process_creation	T1548
Linux Setuid Capability Set on a Binary via Setcap Utility	low	linux / process_creation	T1548
Setuid and Setgid	low	linux / process_creation	T1548.001

Splunk69

Rule	Type	Risk	Data source	Technique
Allow Operation with Consent Admin	TTP	NULL	Sysmon EventID 13	T1548
Disable UAC Remote Restriction	TTP	NULL	Sysmon EventID 13	T1548.002
Disabling Remote User Account Control	TTP	NULL	Sysmon EventID 13	T1548.002
Eventvwr UAC Bypass	TTP	NULL	Sysmon EventID 13	T1548.002
FodHelper UAC Bypass	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1548.002
Linux APT Privilege Escalation	Anomaly	NULL	Sysmon for Linux EventID 1, Cisco Isovalent Process Exec	T1548.003
Linux apt-get Privilege Escalation	Anomaly	NULL	Sysmon for Linux EventID 1, Cisco Isovalent Process Exec	T1548.003
Linux Auditd Doas Conf File Creation	TTP	NULL	Linux Auditd Path, Linux Auditd Cwd	T1548.003
Linux Auditd Doas Tool Execution	Anomaly	NULL	Linux Auditd Syscall	T1548.003
Linux Auditd Nopasswd Entry In Sudoers File	Anomaly	NULL	Linux Auditd Proctitle	T1548.003
Linux Auditd Possible Access To Sudoers File	Anomaly	NULL	Linux Auditd Path, Linux Auditd Cwd	T1548.003
Linux Auditd Setuid Using Chmod Utility	Anomaly	NULL	Linux Auditd Proctitle	T1548.001
Linux Auditd Setuid Using Setcap Utility	TTP	NULL	Linux Auditd Execve	T1548.001
Linux Auditd Sudo Or Su Execution	Anomaly	NULL	Linux Auditd Proctitle	T1548.003
Linux AWK Privilege Escalation	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.003
Linux Busybox Privilege Escalation	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.003
Linux c89 Privilege Escalation	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.003
Linux c99 Privilege Escalation	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.003
Linux Common Process For Elevation Control	Hunting	NULL	Sysmon for Linux EventID 1	T1548.001
Linux Composer Privilege Escalation	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.003
Linux Cpulimit Privilege Escalation	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.003
Linux Csvtool Privilege Escalation	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.003
Linux Dirty Frag Kernel Privilege Escalation	TTP	NULL	Linux Auditd Syscall	T1548.001
Linux Doas Conf File Creation	Anomaly	NULL	Sysmon for Linux EventID 11	T1548.003
Linux Doas Tool Execution	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.003
Linux Docker Privilege Escalation	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.003
Linux Emacs Privilege Escalation	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.003
Linux Find Privilege Escalation	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.003
Linux GDB Privilege Escalation	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.003
Linux Gem Privilege Escalation	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.003
Linux GNU Awk Privilege Escalation	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.003
Linux Make Privilege Escalation	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.003
Linux MySQL Privilege Escalation	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.003
Linux Node Privilege Escalation	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.003
Linux NOPASSWD Entry In Sudoers File	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.003
Linux Octave Privilege Escalation	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.003
Linux OpenVPN Privilege Escalation	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.003
Linux Persistence and Privilege Escalation Risk Behavior	Correlation	NULL		T1548
Linux PHP Privilege Escalation	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.003
Linux Possible Access To Sudoers File	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.003
Linux Puppet Privilege Escalation	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.003
Linux RPM Privilege Escalation	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.003
Linux Ruby Privilege Escalation	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.003
Linux Setuid Using Chmod Utility	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.001
Linux Setuid Using Setcap Utility	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.001
Linux Sqlite3 Privilege Escalation	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.003
Linux Sudo OR Su Execution	Hunting	NULL	Sysmon for Linux EventID 1	T1548.003
Linux Sudoers Tmp File Creation	Anomaly	NULL	Sysmon for Linux EventID 11	T1548.003
Linux Telnet Authentication Bypass	TTP	NULL	Sysmon for Linux EventID 1	T1548
Linux Usermod Root UID Set	TTP	NULL	Sysmon for Linux EventID 1	T1548.001
Linux Visudo Utility Execution	Anomaly	NULL	Sysmon for Linux EventID 1	T1548.003
NET Profiler UAC bypass	TTP	NULL	Sysmon EventID 13	T1548.002
Sdclt UAC Bypass	TTP	NULL	Sysmon EventID 12, Sysmon EventID 13	T1548.002
Services Escalate Exe	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1548
SilentCleanup UAC Bypass	TTP	NULL	Sysmon EventID 13	T1548.002
SLUI RunAs Elevated	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1548.002
SLUI Spawning a Process	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1548.002
UAC Bypass MMC Load Unsigned Dll	TTP	NULL	Sysmon EventID 7	T1548.002
Windows Bypass UAC via Pkgmgr Tool	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1548.002
Windows ComputerDefaults Spawning a Process	TTP	NULL	Sysmon EventID 1	T1548.002
Windows DISM Install PowerShell Web Access	TTP	NULL	Windows Event Log Security 4688, Sysmon EventID 1	T1548.002
Windows Mock Trusted Directory MSC File Creation	TTP	NULL	Sysmon EventID 11	T1548.002
Windows Privilege Escalation Suspicious Process Elevation	TTP	NULL	Sysmon EventID 1 AND Sysmon EventID 1	T1548
Windows Privilege Escalation System Process Without System Parent	TTP	NULL	Sysmon EventID 1	T1548
Windows Privilege Escalation User Process Spawn System Process	TTP	NULL	Sysmon EventID 1 AND Sysmon EventID 1	T1548
Windows Suspicious Child Process of Consent.EXE	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1548.002
Windows UAC Bypass Suspicious Child Process	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1548.002
Windows UAC Bypass Suspicious Escalation Behavior	TTP	NULL	Sysmon EventID 1 AND Sysmon EventID 1	T1548.002
WSReset UAC Bypass	TTP	NULL	Sysmon EventID 12, Sysmon EventID 13	T1548.002

Sub-techniques6

ID	Name	Examples
T1548.001	Setuid and Setgid	2
T1548.002	Bypass User Account Control	63
T1548.003	Sudo and Sudo Caching	6
T1548.004	Elevated Execution with Prompt	1
T1548.005	Temporary Elevated Cloud Access	0
T1548.006	TCC Manipulation	1

Groups1

UNC3886

Software1

Raspberry Robin

Campaigns0

None recorded.

Procedure examples2

Groups1

Used by	Procedure example
GroupUNC3886	UNC3886 has used vSphere Installation Bundles (VIBs) that contained modified descriptor XML files with the `acceptance-level` set to `partner` which allowed for privilege escalation. Google Cloud Threat Intelligence ESXi VIBs 2022

Software1

Used by	Procedure example
MalwareRaspberry Robin	Raspberry Robin implements a variation of the `ucmDccwCOMMethod` technique abusing the Windows AutoElevate backdoor to bypass UAC while elevating privileges. TrendMicro RaspberryRobin 2022

References4

Fortinet Fareit Open source
Salvio, J., Joven, R. (2016, December 16). Malicious Macro Bypasses UAC to Elevate Privilege for Fareit Malware. Retrieved December 27, 2016.
OSX Keydnap malware Open source
Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware is hungry for credentials. Retrieved July 3, 2017.
TechNet How UAC Works Open source
Lich, B. (2016, May 31). How User Account Control Works. Retrieved June 3, 2016.
sudo man page 2018 Open source
Todd C. Miller. (2018). Sudo Man Page. Retrieved March 19, 2018.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.