1. Home
  2. ATT&CK Techniques
  3. T1548 Abuse Elevation Control Mechanism

T1548 Abuse Elevation Control Mechanism Mappings

Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.

View in MITRE ATT&CK®

NIST 800-53 Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
AC-16 Security and Privacy Attributes Protects T1548 Abuse Elevation Control Mechanism
AC-2 Account Management Protects T1548 Abuse Elevation Control Mechanism
AC-3 Access Enforcement Protects T1548 Abuse Elevation Control Mechanism
AC-5 Separation of Duties Protects T1548 Abuse Elevation Control Mechanism
AC-6 Least Privilege Protects T1548 Abuse Elevation Control Mechanism
CA-7 Continuous Monitoring Protects T1548 Abuse Elevation Control Mechanism
CA-8 Penetration Testing Protects T1548 Abuse Elevation Control Mechanism
CM-2 Baseline Configuration Protects T1548 Abuse Elevation Control Mechanism
CM-5 Access Restrictions for Change Protects T1548 Abuse Elevation Control Mechanism
CM-6 Configuration Settings Protects T1548 Abuse Elevation Control Mechanism
CM-7 Least Functionality Protects T1548 Abuse Elevation Control Mechanism
CM-8 System Component Inventory Protects T1548 Abuse Elevation Control Mechanism
IA-2 Identification and Authentication (organizational Users) Protects T1548 Abuse Elevation Control Mechanism
RA-5 Vulnerability Monitoring and Scanning Protects T1548 Abuse Elevation Control Mechanism
SC-18 Mobile Code Protects T1548 Abuse Elevation Control Mechanism
SC-34 Non-modifiable Executable Programs Protects T1548 Abuse Elevation Control Mechanism
SI-12 Information Management and Retention Protects T1548 Abuse Elevation Control Mechanism
SI-16 Memory Protection Protects T1548 Abuse Elevation Control Mechanism
SI-3 Malicious Code Protection Protects T1548 Abuse Elevation Control Mechanism
SI-4 System Monitoring Protects T1548 Abuse Elevation Control Mechanism
SI-7 Software, Firmware, and Information Integrity Protects T1548 Abuse Elevation Control Mechanism

Azure Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
alerts_for_windows_machines Alerts for Windows Machines technique_scores T1548 Abuse Elevation Control Mechanism
Comments
The only sub-technique scored (Bypass User Account Control) is the only one relevant to Windows.
References
  1. https://docs.microsoft.com/en-us/azure/security-center/defender-for-servers-introduction
  2. https://docs.microsoft.com/en-us/azure/security-center/alerts-reference#alerts-windows
azure_sentinel Azure Sentinel technique_scores T1548 Abuse Elevation Control Mechanism
Comments
This control can identify one of this technique's sub-techniques when executed via "Powershell Empire cmdlets seen in command line", but does not address other procedures.
References
  1. https://docs.microsoft.com/en-us/azure/sentinel/overview
  2. https://docs.microsoft.com/en-us/azure/sentinel/hunting
file_integrity_monitoring File Integrity Monitoring technique_scores T1548 Abuse Elevation Control Mechanism
Comments
References
  1. https://docs.microsoft.com/en-us/azure/security-center/security-center-file-integrity-monitoring
docker_host_hardening Docker Host Hardening technique_scores T1548 Abuse Elevation Control Mechanism
Comments
This control is only relevant for Linux endpoints containing Docker containers.
References
  1. https://docs.microsoft.com/en-us/azure/security-center/harden-docker-hosts

ATT&CK Subtechniques

Technique ID Technique Name Number of Mappings
T1548.002 Bypass User Account Control 15
T1548.004 Elevated Execution with Prompt 11
T1548.001 Setuid and Setgid 4
T1548.003 Sudo and Sudo Caching 14