T1548 · Abuse Elevation Control Mechanism

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1548 · Abuse Elevation Control Mechanism · Sunturai

attack-patternenterprise-attackT1548

Abuse Elevation Control Mechanism

attack-pattern--67720091-eee3-4d2d-ae16-8264567f6f5b

Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.(Citation: TechNet How UAC Works) (Citation: sudo man page 2018) An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.(Citation: OSX Keydnap malware) (Citation: Fortinet Fareit)

Created: Jan 30, 2020, 1:58 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

6 sub-techniques under this technique

Each is its own technique in the catalogue, with its own detections.

168 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Silverfort - NoPacBreach Incident	High	Microsoft Sentinel analytics	Oct 14, 2026	MIT License
File Execution Permission Modification Detected via Defend for Containers	Low	Elastic detection rules	Oct 10, 2026	Elastic License 2.0
Unusual Pkexec Execution	High	Elastic detection rules	Oct 9, 2026	Elastic License 2.0
Potential Privacy Control Bypass via Localhost Secure Copy	High	Elastic detection rules	Oct 8, 2026	Elastic License 2.0
Excessive Sudo Authentication Failures via macOS Security Events	Low	Elastic detection rules	Oct 8, 2026	Elastic License 2.0
UAC Bypass via Windows Firewall Snap-In Hijack	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
UAC Bypass Attempt via Windows Directory Masquerading	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Bypass UAC via Event Viewer	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
UAC Bypass Attempt via Privileged IFileOperation COM Interface	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
UAC Bypass via DiskCleanup Scheduled Task Hijack	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
UAC Bypass via ICMLuaUtil Elevated COM Interface	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Disabling User Account Control via Registry Modification	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential PowerShell HackTool Script by Function Names	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Local Account TokenFilter Policy Disabled	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual Sudo Activity	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Execution with Explicit Credentials via Scripting	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Apple Scripting Execution with Administrator Privileges	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Execution via Electron Child Process Node.js Module	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Full Disk Access Permission Check	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious TCC Access Granted for User Folders	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Privacy Control Bypass via TCCDB Modification	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
UID Elevation from Previously Unknown Executable	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Privilege Escalation via Recently Compiled Executable	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0

Showing 25 of 168

Filter in the catalogue

External references

mitre-attackT1548Open reference

TechNet How UAC WorksOpen reference

OSX Keydnap malwareOpen reference

Fortinet FareitOpen reference

sudo man page 2018Open reference

Platforms

IaaSIdentity ProviderLinuxmacOSOffice SuiteWindows

Kill chain phases

privilege-escalation

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object