| name | T1548_abuse-elevation-control-mechanism |
| description | Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. |
| category | authorization |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1548","privilege-escalation","defense-evasion","linux","macos","windows","iaas","office-suite","identity-provider"] |
| technique_id | T1548 |
| tactic | privilege-escalation |
| all_tactics | ["privilege-escalation","defense-evasion"] |
| platforms | ["Linux","macOS","Windows","IaaS","Office Suite","Identity Provider"] |
| mitre_url | https://attack.mitre.org/techniques/T1548 |
| tech_stack | ["linux","macos","windows","cloud","office","identity"] |
| cwe_ids | ["CWE-269"] |
| chains_with | ["T1548.001","T1548.002","T1548.003","T1548.004","T1548.005","T1548.006"] |
| prerequisites | [] |
| severity_boost | {"T1548.001":"Chain with T1548.001 for deeper attack path","T1548.002":"Chain with T1548.002 for deeper attack path","T1548.003":"Chain with T1548.003 for deeper attack path"} |
T1548 Abuse Elevation Control Mechanism
High-Level Description
Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Kill Chain Phase
- Privilege Escalation (TA0004)
- Defense Evasion (TA0005)
Platforms: Linux, macOS, Windows, IaaS, Office Suite, Identity Provider
What to Check
How to Test
Manual Testing
-
Identify Attack Surface: Determine if the target environment is susceptible to Abuse Elevation Control Mechanism by examining the target platforms (Linux, macOS, Windows).
-
Assess Existing Defenses: Review whether mitigations for T1548 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
-
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
Remediation Guide
M1038 Execution Prevention
System settings can prevent applications from running that haven't been downloaded from legitimate repositories which may help mitigate some of these issues. Not allowing unsigned applications from being run may also mitigate some risk.
