1. Home
  2. ATT&CK Techniques
  3. T1548 Abuse Elevation Control Mechanism

T1548 Abuse Elevation Control Mechanism

Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.(Citation: TechNet How UAC Works)(Citation: sudo man page 2018) An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.(Citation: OSX Keydnap malware)(Citation: Fortinet Fareit)

View in MITRE ATT&CK®

CIS Controls Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
CIS-6.8 Define and Maintain Role-Based Access Control mitigates T1548 Abuse Elevation Control Mechanism
Comments
Role-based access control (RBAC), implemented under least privilege and access enforcement controls, helps mitigate this technique by limiting which identities can use elevation mechanisms and what they can elevate to.
References
  1. https://cas.docs.cisecurity.org/en/latest/source/Controls6/#68-define-and-maintain-role-based-access-control
CIS-7.7 Remediate Detected Vulnerabilities mitigates T1548 Abuse Elevation Control Mechanism
Comments
This is a partial parent mapping because remediation can remove known vulnerabilities and implementation weaknesses used to bypass elevation controls.
References
  1. https://cas.docs.cisecurity.org/en/latest/source/Controls7/#77-remediate-detected-vulnerabilities
CIS-7.3 Perform Automated Operating System Patch Management mitigates T1548 Abuse Elevation Control Mechanism
Comments
OS updates can close vulnerabilities and implementation weaknesses used to bypass native elevation mechanisms, especially UAC, but they do not prevent abuse of sudo permissions, temporary cloud elevation, or other correctly functioning mechanisms.
References
    CIS-5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts mitigates T1548 Abuse Elevation Control Mechanism
    Comments
    The safeguard limits which accounts can legitimately elevate, reducing the opportunity to abuse elevation paths from compromised routine accounts.
    References
    1. https://cas.docs.cisecurity.org/en/latest/source/Controls5/

    VERIS Mappings

    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
    action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1548 Abuse Elevation Control Mechanism
    action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1548 Abuse Elevation Control Mechanism

    GCP Mappings

    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
    google_secops Google Security Operations technique_scores T1548 Abuse Elevation Control Mechanism
    Comments
    Google Security Ops is able to trigger an alert based on Custom Role changes. This technique was scored as minimal based on low or uncertain detection coverage factor. https://github.com/chronicle/detection-rules/blob/783e0e5947774785db1c55041b70176deeca6f46/gcp_cloudaudit/gcp_custom_role_changes.yaral
    References
    1. https://cloud.google.com/security/products/security-operations
    2. https://cloud.google.com/chronicle/docs/secops/secops-overview
    3. https://github.com/chronicle/detection-rules

    AWS Mappings

    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
    amazon_inspector Amazon Inspector technique_scores T1548 Abuse Elevation Control Mechanism
    Comments
    The Amazon Inspector Best Practices assessment package can assess security control "Configure permissions for system directories" that prevents privilege escalation by local users and ensures only the root account can modify/execute system configuration information and binaries. Amazon Inspector does not directly protect against system modifications rather it just checks to see if security controls are in place which can inform decisions around hardening the system. Furthermore, Amazon Inspector only supports a subset of the sub-techniques for this technique. Due to these things and the fact the security control is only supported for Linux platforms, the score is Minimal.
    References
    1. https://docs.aws.amazon.com/inspector/latest/userguide/inspector_introduction.html

    ATT&CK Subtechniques

    Technique ID Technique Name Number of Mappings
    T1548.002 Bypass User Account Control 9
    T1548.003 Sudo and Sudo Caching 6
    T1548.001 Setuid and Setgid 1
    T1548.005 Temporary Elevated Cloud Access 7
    T1548.004 Elevated Execution with Prompt 3
    T1548.006 TCC Manipulation 4