[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1548":3},{"item":4,"lessons":18,"controls":52,"related":79},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1548","T1548","Abuse Elevation Control Mechanism",8,"MITRE","**What attackers do.** Attackers bypass or abuse the mechanisms that control privilege elevation, such as Windows User Account Control, sudo, setuid binaries or cloud temporary elevated access, to gain higher permissions. This serves Privilege Escalation and Defence Evasion.\n\n**How to defend.** Set User Account Control to its highest practical level and do not let everyday users work as local administrators. Review sudo rules and setuid binaries, and require approval and logging for temporary cloud elevation. Patch known bypasses where vendors provide fixes.\n\n**Signs to look for.** Look for registry changes associated with UAC bypass, auto-elevating binaries launching unexpected children, new setuid files, unusual sudo usage and elevation requests outside normal patterns. A common gap is local admin rights making many bypasses unnecessary.","Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1548\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48],{"slug":21,"title":22,"published_at":23},"critical-flaws-in-privileged-access-manager-highlight-pam-security-risks","Critical Flaws in Privileged Access Manager Highlight PAM Security Risks","2026-10-03T12:20:58.495+00:00",{"slug":25,"title":26,"published_at":27},"fake-zoom-installer-deploys-macos-backdoor-via-social-engineering","Fake Zoom Installer Deploys macOS Backdoor via Social Engineering","2026-10-02T14:20:22.101+00:00",{"slug":29,"title":30,"published_at":31},"spear-phishing-campaign-deploys-multi-stage-backdoor-against-law-firm","Spear-Phishing Campaign Deploys Multi-Stage Backdoor Against Law Firm","2026-07-31T18:20:57.433+00:00",{"slug":33,"title":34,"published_at":35},"confused-deputy-flaws-enable-privilege-escalation-in-google-cloud-and-azure","Confused Deputy Flaws Enable Privilege Escalation in Google Cloud and Azure","2026-07-27T22:20:56.996+00:00",{"slug":37,"title":38,"published_at":39},"windows-bind-links-weaponized-to-blind-edr-tools","Windows Bind Links Weaponized to Blind EDR Tools","2026-07-15T14:20:40.679+00:00",{"slug":41,"title":42,"published_at":43},"record-breaking-patch-tuesday-622-flaws-including-two-actively-exploited-zero-days","Record-Breaking Patch Tuesday: 622 Flaws Including Two Actively Exploited Zero-Days","2026-07-15T12:20:39.017+00:00",{"slug":45,"title":46,"published_at":47},"ai-accelerated-cloud-breach-achieved-in-72-hours-via-stolen-credentials","AI-Accelerated Cloud Breach Achieved in 72 Hours via Stolen Credentials","2026-07-08T22:20:59.713+00:00",{"slug":49,"title":50,"published_at":51},"macos-xpc-flaw-let-unprivileged-users-disable-edr-and-mdm-security-tools","macOS XPC Flaw Let Unprivileged Users Disable EDR and MDM Security Tools","2026-06-26T14:21:02.48+00:00",[53,58,62,67,71,75],{"slug":54,"name":55,"problem":56,"stories":57},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",5,{"slug":59,"name":60,"problem":61,"stories":57},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":63,"name":64,"problem":65,"stories":66},"patch-management","Automated patch management","Known holes get closed in days, not months.",2,{"slug":68,"name":69,"problem":70,"stories":66},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",{"slug":72,"name":73,"problem":74,"stories":66},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":76,"name":77,"problem":78,"stories":66},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[80,86,91,95,99,103,107,111],{"family":81,"item":82,"code":83,"title":84,"together":85},"nist-800-53","ac-6","AC-6","Least Privilege",6,{"family":81,"item":87,"code":88,"title":89,"together":90},"ac-2","AC-2","Account Management",3,{"family":92,"item":93,"code":94,"title":89,"together":90},"cis","5","Control 5",{"family":92,"item":96,"code":97,"title":98,"together":90},"7","Control 7","Continuous Vulnerability Management",{"family":92,"item":100,"code":101,"title":102,"together":90},"2","Control 2","Inventory and Control of Software Assets",{"family":104,"item":105,"code":106,"title":106,"together":90},"itil","overview","ITIL",{"family":92,"item":108,"code":109,"title":110,"together":90},"10","Control 10","Malware Defenses",{"family":92,"item":112,"code":113,"title":114,"together":90},"8","Control 8","Audit Log Management"]