Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.[1][2] An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.[3][4]
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.
0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.
1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.
31
Detection rulesTop 8%
Detection rules92nd percentile · 91% of ATT&CK techniques have fewer detection rules written.
Abuse Elevation Control Mechanism MITRE reference T1548
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has used vSphere Installation Bundles (VIBs) that contained modified descriptor XML files with the acceptance-level set to partner which allowed for privilege escalation.1
created 2025-05-291 reference
All 1 groups for this technique
1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Abuse Elevation Control Mechanism detection strategy DET0345
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Abuse Elevation Control Mechanism (T1548)
Enterprise
5 platforms
AN0975 · Windows
Correlate registry modifications (e.g., UAC bypass registry keys), unusual parent-child process relationships (e.g., control.exe spawning cmd.exe), and unsigned elevated process executions with non-standard tokens or elevation flags.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
ElevatedProcessPath
Paths to monitor for unsigned or unexpected elevated binaries
ParentProcessName
Parent-child execution chains that are suspicious in the local environment
TimeWindow
Time between registry modification and elevated process spawn
AN0976 · Linux
Monitor audit logs for setuid/setgid bit changes, executions where UID ≠ EUID (indicative of sudo or privilege escalation), and high-integrity binaries launched by unprivileged users.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
WatchedDirectories
Paths where unauthorized setuid binaries may be dropped
UserContext
Which users are allowed to run sudo/pkexec or modify binaries
TimeWindow
Duration between file permission change and elevated command execution
AN0977 · macOS
Detect execution of /usr/libexec/security_authtrampoline or use of AuthorizationExecuteWithPrivileges API, and monitor process lineage for unusual launches of GUI apps with escalated privileges.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
WatchedBinaries
Specify binaries frequently targeted for privilege escalation
ExecutionParent
Which applications should never be allowed to spawn elevated processes
AN0978 · Identity Provider
Monitor for unexpected privilege elevation operations via SAML assertion manipulation, role injection, or changes to identity mappings that result in access escalation.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
AuthorizedRoleMappings
Roles or groups that should never be assumed outside designated paths
TimeWindow
Time between assertion issuance and critical privilege use
AN0979 · IaaS
Detect sudden privilege escalations such as IAM role changes, user-assigned privilege boundaries, or elevation via assumed roles beyond normal behavior.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
PermittedRoleTransitions
Define valid transitions between IAM roles
CrossAccountBoundary
Should flag if assumption crosses trust boundary
1 analytic
Cyber actors frequently escalate to the SYSTEM account after gaining entry to a Windows host, to enable them to carry out various attacks more effectively. Tools such as Meterpreter, Cobalt Strike, and Empire carry out automated steps to "Get System", which is the same as switching over to the System user account. Most of these tools utilize multiple techniques to try and attain SYSTEM: in the first technique, they create a named pipe and connects an instance of cmd.exe to it, which allows them to impersonate the security context of cmd.exe, which is SYSTEM. In the second technique, a malicious DLL is injected into a process that is running as SYSTEM; the injected DLL steals the SYSTEM token and applies it where necessary to escalate privileges. This analytic looks for both of these techniques.
TypeTTPCoverageModerateSubmitted2021
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
This is a pseudocode representation of the below splunk search.
processes = search Process
suspicious_processes = filter processes where (
(parent_image_path == C:\Windows\System32\services.exe" AND
image_path == "C:\Windows\System32\cmd.exe" AND
command_line == "*echo*" AND
command_line == "*\pipe\*") OR
(image_path == "C:\Windows\System32\rundll32.exe" AND
command_line == "*,a /p:*"))
output suspicious_processes
This is a pseudocode representation of the below splunk search.
processes = search Process
suspicious_processes = filter processes where (
(image_path == "C:\Windows\System32\cmd.exe" OR
command_line == "*%COMSPEC%*") AND
command_line == "*echo*" AND
command_line == "*\pipe\*"))
output suspicious_processes
Look for instances GetSystem elevation performed by Meterpreter or Cobalt Strike
index=__your_sysmon_index__ (ParentImage="C:\\Windows\\System32\\services.exe" Image="C:\\Windows\\System32\\cmd.exe" (CommandLine="*echo*" AND CommandLine="*\\pipe\\*"))
OR (Image="C:\\Windows\\System32\\rundll32.exe" CommandLine="*,a /p:*")
Look for instances GetSystem elevation performed by Empire or PoshC2
index=__your_sysmon_index__ (Image="C:\\Windows\\System32\\cmd.exe" OR CommandLine="*%COMSPEC%*") (CommandLine="*echo*" AND CommandLine="*\pipe\*")
Unit tests
CAR’s own validation procedures for this analytic.
System settings can prevent applications from running that haven't been downloaded from legitimate repositories which may help mitigate some of these issues. Not allowing unsigned applications from being run may also mitigate some risk.
Applications with known vulnerabilities or known shell escapes should not have the setuid or setgid bits set to reduce potential damage if an application is compromised. Additionally, the number of programs with setuid or setgid bits set should be minimized across a system. Ensuring that the sudo tty_tickets setting is enabled will prevent this leakage across tty sessions.
Remove users from the local administrator group on systems.
By requiring a password, even if an adversary can get terminal access, they must know the password to run anything in the sudoers file. Setting the timestamp_timeout to 0 will require the user to input their password every time sudo is executed.
The sudoers file should be strictly edited such that passwords are always required and that users can't spawn risky processes as users with higher privilege.
Although UAC bypass techniques exist, it is still prudent to use the highest enforcement level for UAC when possible and mitigate bypass opportunities that exist with techniques such as DLL.
Limit the privileges of cloud accounts to assume, create, or impersonate additional roles, policies, and permissions to only those required. Where just-in-time access is enabled, consider requiring manual approval for temporary elevation of privileges.
Abuse Elevation Control Mechanism detections T1548
31 rules are mapped to this technique.
Top 8%of all ATT&CK techniques for number of rules
Showing 1-31 of 31 rules
Drag headers to reorder | Drag edges to resize
Select
Title
Description
Category
Status
Event
OS
Product
MITRE ATT&CK
CVEs
Severity
Author
Created
Updated
ID
Refs
Detection of unusual child processes by different system processes
The following analytic detects a registry modification that allows the 'Consent Admin' to perform operations requiring elevation without user consent or credentials. (...)
Detects attempts of an attacker to enable core dumps for set-user-ID (SUID) processes by modifying the system file /proc/sys/fs/suid_dumpable, typically by setting its value to 1 or 2. (...)
Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account. (...)
The following analytic identifies the execution of a randomly named binary via `services.exe`, indicative of privilege escalation using Cobalt Strike's `svc-exe`. (...)
The following analytic detects when a process running with low or medium integrity from a user account spawns an elevated process with high or system integrity in suspicious locations. (...)
The following analytic detects when a process with low, medium, or high integrity spawns a system integrity process from a user-controlled location. (...)