Applied Cybernetics Group
T1548 Abuse Elevation Control Mechanism
- Technique
T1548- Tactics
- Privilege Escalation
- Research, 90 days
- 1
- KEV CVEs mapped
- 4
- SigmaHQ rules
- 23
- Elastic, Splunk
- 82
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1548
MITRE description
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.(Citation: TechNet How UAC Works)(Citation: sudo man page 2018) An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.(Citation: OSX Keydnap malware)(Citation: Fortinet Fareit)
KEV CVEs mapped to this technique
MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-08-13Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them
Detection coverage
SigmaHQ community rules
- Potential Exploitation of CVE-2025-5054 or CVE-2025-4598 (emerging-threats)
- AWS STS AssumeRole Misuse (core)
- AWS STS GetSessionToken Misuse (core)
- AWS Suspicious SAML Activity (core)
- CA Policy Removed by Non Approved Actor (core)
- CA Policy Updated by Non Approved Actor (core)
- New CA Policy by Non-approved Actor (core)
- User Added To Group With CA Policy Modification Access (core)
- User Removed From Group With CA Policy Modification Access (core)
- GCP Break-glass Container Workload Deployed (core)
- Linux Capabilities Discovery (core)
- Linux Doas Conf File Creation (core)
- Linux Setgid Capability Set on a Binary via Setcap Utility (core)
- Linux Setuid Capability Set on a Binary via Setcap Utility (core)
- Linux Doas Tool Execution (core)
- Potential Privilege Escalation via Local Kerberos Relay over LDAP (core)
- SCM Database Privileged Operation (core)
- Vulnerable Netlogon Secure Channel Connection Allowed (core)
- Credential Dumping Attempt Via Svchost (core)
- Regedit as Trusted Installer (core)
- Abused Debug Privilege by Arbitrary Parent Processes (core)
- UAC Bypass via Windows Firewall Snap-In Hijack (core)
- COM Hijack via Sdclt (core)
Elastic and Splunk rules
- Potential Privilege Escalation via Sudoers File Modification (elastic)
- SUID/SGID Bit Set (elastic)
- Sudoers File Activity (elastic)
- AWS STS AssumeRole with New MFA Device (elastic)
- AWS EC2 Instance Profile Associated with Running Instance (elastic)
- AWS IAM Customer-Managed Policy Attached to Role by Rare User (elastic)
- AWS IAM Customer Managed Policy Version Created or Default Version Set (elastic)
- AWS KMS Key Policy Updated via PutKeyPolicy (elastic)
- AWS STS Role Assumption by Service (elastic)
- AWS STS Role Assumption by User (elastic)
- AWS STS AssumeRoot by Rare User and Member Account (elastic)
- AWS STS GetFederationToken with AdministratorAccess in Request (elastic)
- AWS STS Role Chaining (elastic)
- Entra ID Actor Token User Impersonation Abuse (elastic)
- File Execution Permission Modification Detected via Defend for Containers (elastic)
- Modification of Persistence Relevant Files Detected via Defend for Containers (elastic)
- Suspicious Echo or Printf Execution Detected via Defend for Containers (elastic)
- Potential Persistence via File Modification (elastic)
- Excessive Sudo Authentication Failures via macOS Security Events (elastic)
- Spike in Privileged Command Execution by a User (elastic)
- Unusual Process Detected for Privileged Commands by a User (elastic)
- Potential Defense Evasion via Doas (elastic)
- Sudo Command Enumeration Detected (elastic)
- SUID/SGUID Enumeration Detected (elastic)
- Suspicious File Made Executable via Chmod Inside A Container (elastic)
Showing 25 of 82.