THREATNOIR
Subscribe
MITRE ATT&CK · T1548

Abuse Elevation Control Mechanism

MITRE · cited in 8 of our lessons

Explanation

What attackers do. Attackers bypass or abuse the mechanisms that control privilege elevation, such as Windows User Account Control, sudo, setuid binaries or cloud temporary elevated access, to gain higher permissions. This serves Privilege Escalation and Defence Evasion.

How to defend. Set User Account Control to its highest practical level and do not let everyday users work as local administrators. Review sudo rules and setuid binaries, and require approval and logging for temporary cloud elevation. Patch known bypasses where vendors provide fixes.

Signs to look for. Look for registry changes associated with UAC bypass, auto-elevating binaries launching unexpected children, new setuid files, unusual sudo usage and elevation requests outside normal patterns. A common gap is local admin rights making many bypasses unnecessary.

Open the technique on MITRE ATT&CK
The official text
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.