OSX/ShlayerS0402 ↗
Can escalate privileges to root by asking the user for credentials.1
tfMITRE ATT&CK sub-technique
Elevated Execution with Prompt T1548.004
sub-technique of T1548 Abuse Elevation Control Mechanism
- Tactic
- Privilege Escalation
- Platform
- macOS
- Version
- 2.0
- Created
- 30 January 2020
- Last modified
- 12 May 2026
- Contributors
- Jimmy Astle, @AstleJimmy, Carbon Black; Erika Noerenberg, @gutterchurl, Carbon Black
Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials.[1] The purpose of this API is to give application developers an easy way to perform operations with root privileges, such as for application installation or updating. This API does not validate that the program requesting root privileges comes from a reputable source or has been maliciously modified.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Elevated Execution with Prompt MITRE reference T1548.004
44th pctamong all ATT&CK techniques for number of tools
1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
All 1 software entries for this technique
Offense vs defense T1548.004
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Elevated Execution with Prompt detection strategy DET0395
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
macOS AuthorizationExecuteWithPrivileges Elevation Prompt Detection
1 platform
AN1111 · macOS
Detects abuse of AuthorizationExecuteWithPrivileges API to gain elevated privileges via user credential prompts, typically through invocation of /usr/libexec/security_authtrampoline. Detection involves correlation of API usage, binary reputation, and prompt context.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | macos:unifiedlog | User credential prompt events without associated trusted installer package |
| OS API ExecutionDC0021 | macos:unifiedlog | Calls to AuthorizationExecuteWithPrivileges() observed via Apple System Logger or security_auditing tools |
| Process CreationDC0032 | macos:unifiedlog | Execution of /usr/libexec/security_authtrampoline or child processes originating from non-trusted binaries triggering credential prompts |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| BinaryReputationList | Allow list of trusted binaries invoking elevation prompts |
| TimeWindow | Temporal correlation threshold between API call and credential prompt |
| PromptContextValidation | Heuristic filters to determine whether a prompt context matches known legitimate installers |
Execution PreventionM1038
System settings can prevent applications from running that haven't been downloaded through the Apple Store which may help mitigate some of these issues. Not allowing unsigned applications from being run may also mitigate some risk.