UNC3886G1048 ↗
Has used vSphere Installation Bundles (VIBs) that contained modified descriptor XML files with the acceptance-level set to partner which allowed for privilege escalation.1
tfMITRE ATT&CK technique
Abuse Elevation Control Mechanism T1548
- Tactic
- Privilege Escalation
- Platforms
- Linux, macOS, Windows, IaaS, Office Suite, Identity Provider
- Version
- 2.0
- Created
- 30 January 2020
- Last modified
- 12 May 2026
Sub-techniques 6154 rules across the family · 31 mapped directly to T1548 · 3 of 6 carry rules
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.[1][2] An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.[3][4]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.31
Detection rulesTop 8%
Detection rules92nd percentile · 92% of ATT&CK techniques have this many detection rules written or fewer.Abuse Elevation Control Mechanism MITRE reference T1548
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 1 groups for this technique
1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Raspberry RobinS1130 ↗
Implements a variation of the ucmDccwCOMMethod technique abusing the Windows AutoElevate backdoor to bypass UAC while elevating privileges.1
All 1 software entries for this technique
Offense vs defense T1548
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 24Splunk ESCU (cumulative) · 7
first rule: 2019 Q3Abuse Elevation Control Mechanism detection strategy DET0345
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Abuse Elevation Control Mechanism (T1548)
5 platforms
AN0975 · Windows
Correlate registry modifications (e.g., UAC bypass registry keys), unusual parent-child process relationships (e.g., control.exe spawning cmd.exe), and unsigned elevated process executions with non-standard tokens or elevation flags.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| Windows Registry Key ModificationDC0063 | WinEventLog:Sysmon | EventCode=13, 14 |
| Logon Session MetadataDC0088 | WinEventLog:Security | EventCode=4672 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ElevatedProcessPath | Paths to monitor for unsigned or unexpected elevated binaries |
| ParentProcessName | Parent-child execution chains that are suspicious in the local environment |
| TimeWindow | Time between registry modification and elevated process spawn |
AN0976 · Linux
Monitor audit logs for setuid/setgid bit changes, executions where UID ≠ EUID (indicative of sudo or privilege escalation), and high-integrity binaries launched by unprivileged users.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| OS API ExecutionDC0021 | auditd:SYSCALL | sudo or pkexec invocation |
| Process MetadataDC0034 | auditd:SYSCALL | execve with UID ≠ EUID |
| File MetadataDC0059 | auditd:SYSCALL | setuid or setgid bit changes |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| WatchedDirectories | Paths where unauthorized setuid binaries may be dropped |
| UserContext | Which users are allowed to run sudo/pkexec or modify binaries |
| TimeWindow | Duration between file permission change and elevated command execution |
AN0977 · macOS
Detect execution of /usr/libexec/security_authtrampoline or use of AuthorizationExecuteWithPrivileges API, and monitor process lineage for unusual launches of GUI apps with escalated privileges.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| OS API ExecutionDC0021 | macos:unifiedlog | authorization execute privilege requests |
| Process CreationDC0032 | fs:fsusage | binary execution of security_authtrampoline |
| Process MetadataDC0034 | auditd:SYSCALL | execve with escalated privileges |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| WatchedBinaries | Specify binaries frequently targeted for privilege escalation |
| ExecutionParent | Which applications should never be allowed to spawn elevated processes |
AN0978 · Identity Provider
Monitor for unexpected privilege elevation operations via SAML assertion manipulation, role injection, or changes to identity mappings that result in access escalation.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account ModificationDC0010 | azure:signinlogs | unusual role assumption or elevation path |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AuthorizedRoleMappings | Roles or groups that should never be assumed outside designated paths |
| TimeWindow | Time between assertion issuance and critical privilege use |
AN0979 · IaaS
Detect sudden privilege escalations such as IAM role changes, user-assigned privilege boundaries, or elevation via assumed roles beyond normal behavior.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account ModificationDC0010 | AWS:CloudTrail | role privilege expansion detected |
| Process MetadataDC0034 | AWS:CloudTrail | cross-account or unexpected assume role |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PermittedRoleTransitions | Define valid transitions between IAM roles |
| CrossAccountBoundary | Should flag if assumption crosses trust boundary |
1 analytic
Cyber actors frequently escalate to the SYSTEM account after gaining entry to a Windows host, to enable them to carry out various attacks more effectively. Tools such as Meterpreter, Cobalt Strike, and Empire carry out automated steps to "Get System", which is the same as switching over to the System user account. Most of these tools utilize multiple techniques to try and attain SYSTEM: in the first technique, they create a named pipe and connects an instance of cmd.exe to it, which allows them to impersonate the security context of cmd.exe, which is SYSTEM. In the second technique, a malicious DLL is injected into a process that is running as SYSTEM; the injected DLL steals the SYSTEM token and applies it where necessary to escalate privileges. This analytic looks for both of these techniques.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PLA | Process Lineage Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | exe |
| process | create | parent_exe |
| process | create | command_line |
| service | create | command_line |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
This is a pseudocode representation of the below splunk search.
processes = search Process suspicious_processes = filter processes where ( (parent_image_path == C:\Windows\System32\services.exe" AND image_path == "C:\Windows\System32\cmd.exe" AND command_line == "*echo*" AND command_line == "*\pipe\*") OR (image_path == "C:\Windows\System32\rundll32.exe" AND command_line == "*,a /p:*")) output suspicious_processes
This is a pseudocode representation of the below splunk search.
processes = search Process suspicious_processes = filter processes where ( (image_path == "C:\Windows\System32\cmd.exe" OR command_line == "*%COMSPEC%*") AND command_line == "*echo*" AND command_line == "*\pipe\*")) output suspicious_processes
Look for instances GetSystem elevation performed by Meterpreter or Cobalt Strike
index=__your_sysmon_index__ (ParentImage="C:\\Windows\\System32\\services.exe" Image="C:\\Windows\\System32\\cmd.exe" (CommandLine="*echo*" AND CommandLine="*\\pipe\\*")) OR (Image="C:\\Windows\\System32\\rundll32.exe" CommandLine="*,a /p:*")
Look for instances GetSystem elevation performed by Empire or PoshC2
index=__your_sysmon_index__ (Image="C:\\Windows\\System32\\cmd.exe" OR CommandLine="*%COMSPEC%*") (CommandLine="*echo*" AND CommandLine="*\pipe\*")
Unit tests
CAR’s own validation procedures for this analytic.
GetSystem in Meterpreter & Cobalt Strike’s Beacon
["cmd.exe /c echo ba80ae80df9 > \\\\.\\pipe\\66bee3","cmd.exe /c echo fvxens > \\\\.\\pipe\\fvxens","rundll32.exe C:\\Users\\user\\AppData\\Local\\Temp\\fvxens.dll,a /p:fvxens"]
GetSystem in Empire & PoshC2
["cmd.exe /C start %COMSPEC% /C `\"timeout /t 3 >nul&&echo TestSVC > \\\\.\\pipe\\TestSVC"]
AuditM1047
Check for common UAC bypass weaknesses on Windows systems to be aware of the risk posture and address issues where appropriate.
Execution PreventionM1038
System settings can prevent applications from running that haven't been downloaded from legitimate repositories which may help mitigate some of these issues. Not allowing unsigned applications from being run may also mitigate some risk.
Applications with known vulnerabilities or known shell escapes should not have the setuid or setgid bits set to reduce potential damage if an application is compromised. Additionally, the number of programs with setuid or setgid bits set should be minimized across a system. Ensuring that the sudo tty_tickets setting is enabled will prevent this leakage across tty sessions.
Remove users from the local administrator group on systems. By requiring a password, even if an adversary can get terminal access, they must know the password to run anything in the sudoers file. Setting the timestamp_timeout to 0 will require the user to input their password every time sudo is executed.
The sudoers file should be strictly edited such that passwords are always required and that users can't spawn risky processes as users with higher privilege.
Update SoftwareM1051
Perform regular software updates to mitigate exploitation risk.
User Account ControlM1052
Although UAC bypass techniques exist, it is still prudent to use the highest enforcement level for UAC when possible and mitigate bypass opportunities that exist with techniques such as DLL.
Limit the privileges of cloud accounts to assume, create, or impersonate additional roles, policies, and permissions to only those required. Where just-in-time access is enabled, consider requiring manual approval for temporary elevation of privileges.