Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.(Citation: TechNet How UAC Works)(Citation: sudo man page 2018) An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.(Citation: OSX Keydnap malware)(Citation: Fortinet Fareit)
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| intel-vt | Intel Virtualization Technology | Win 11, HWESP | T1548 | Abuse Elevation Control Mechanism |
Comments
HW Enforced stack protection (HWESP) relies on Virtualization Based Security (VBS) which use Intel PTT, Intel VT-x, Intel VT-d and Intel BootGuard to ensure the OS components loaded are not tampered with and isolate security sensitive processes. Additionally, it uses Intel Control Flow Enforcement Technology (Intel CET) to allow hardware to ensure that sensitive areas in the regions of memory (such as the stack) for processes are not tampered with by either injecting code or changing the control flow of the code or both.
HWESP includes four components Code Integrity Guard, Arbitrary Code Guard, Control Flow Guard and Shadow Stack protections.
Code Integrity Guard attempts to prevent "... arbitrary code generation by enforcing signature requirements for loading binaries".
Arbitrary Code Guard attempts to ensure "... signed pages are immutable and dynamic code cannot be generated ...".
Control Flow Guard ensures control flow integrity by enforcing "... integrity on indirect calls (forward-edge CFI)."
Shadow Stack ensures control flow integrity by enforcing "... integrity on return addresses on the stack (backward-edge CFI)."
Together these features aim to ensure integrity of binary images run on Windows 11 and prevent dynamic code from running or changing the control flow of the code. Since these features offer real-time protection for sensitive regions of memory, these are marked as offering significant protection.
References
|
| intel-tdt | Intel Threat Detection Technology | CrowdStrike AMS | T1548 | Abuse Elevation Control Mechanism |
Comments
Intel Threat Detection Technology (TDT), combined with CrowdStrike Falcon Accelerated Memory Scanning (CAMS), enhances cybersecurity defenses by enabling faster, real-time detection of Abuse Elevation Control Mechanisms. This integrated solution strengthens CrowdStrike Falcon, improving its ability to detect and mitigate cyber threats earlier in the kill chain, while minimizing system performance impact.
Abuse Elevation Control Mechanisms involves adversaries exploiting weaknesses in the operating system or applications to elevate privileges, often bypassing security mechanisms designed to prevent unauthorized access. Attackers typically target flaws in User Account Control (UAC), credential validation, or other access controls to escalate privileges to administrative or system levels. Once elevated, they can execute malicious code, access sensitive information, or further compromise the system. Intel TDT plays a crucial role in identifying these threats by providing real-time telemetry on program execution, memory access, and control flow, enabling rapid detection of abnormal behaviors that indicate abuse of elevation control mechanisms.
Additionally, CAMS offloads the performance-intensive memory scanning tasks from the CPU to the Intel Integrated GPU, allowing for faster, more efficient detection of malicious activity without impacting system performance. CAMS can identify suspicious behaviors such as attempts to bypass UAC prompts or the unauthorized elevation of privileges, which are indicative of efforts to gain unauthorized access to higher system privileges.
References
|
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1548.002 | Bypass User Account Control | 1 |