Techniques › T1548
T1548 Abuse Elevation Control Mechanism
privilege escalation — Linux, macOS, Windows, IaaS, Office Suite, Identity Provider · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
24
Sigma rules tagged attack.t1548
4
KEV CVEs mapped here
<p>Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2023-44221 | SonicWall SMA100 Appliances | exploitation technique | Mapped | 2025-05-01 |
| CVE-2025-2783 | Google Chromium Mojo | primary impact | Mapped | 2025-03-27 |
| CVE-2022-1388 | F5 BIG-IP | exploitation technique | Mapped | 2022-05-10 |
| CVE-2022-23131 | Zabbix Frontend | primary impact | Mapped | 2022-02-22 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0345 Detection Strategy for Abuse Elevation Control Mechanism (T1548) v1.0
AN0975 WindowsCorrelate registry modifications (e.g., UAC bypass registry keys), unusual parent-child process relationships (e.g., control.exe spawning cmd.exe), and unsigned elevated process executions with non-standard tokens or elevation flags.Tunable:
ElevatedProcessPathParentProcessNameTimeWindowAN0976 LinuxMonitor audit logs for setuid/setgid bit changes, executions where UID ≠ EUID (indicative of sudo or privilege escalation), and high-integrity binaries launched by unprivileged users.Tunable:WatchedDirectoriesUserContextTimeWindowAN0977 macOSDetect execution of/usr/libexec/security_authtrampolineor use of AuthorizationExecuteWithPrivileges API, and monitor process lineage for unusual launches of GUI apps with escalated privileges.Tunable:WatchedBinariesExecutionParentAN0978 Identity ProviderMonitor for unexpected privilege elevation operations via SAML assertion manipulation, role injection, or changes to identity mappings that result in access escalation.Tunable:AuthorizedRoleMappingsTimeWindowAN0979 IaaSDetect sudden privilege escalations such as IAM role changes, user-assigned privilege boundaries, or elevation via assumed roles beyond normal behavior.Tunable:PermittedRoleTransitionsCrossAccountBoundary
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1548
Author: Sittikorn S, Teoderick Contreras
· 2022-01-20 (modified 2022-12-31) · logsource: product=linux category=file_event · 00eee2a5-fdb0-4746-a21d-e43fbdea5681
Detects the creation of doas.conf file in linux host platform.
Author: Sittikorn S, Teoderick Contreras
· 2022-01-20 · logsource: product=linux category=process_creation · 067d8238-7127-451c-a9ec-fa78045b618b
Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does.
Author: Omkar Gudhate
· 2020-09-27 (modified 2023-09-28) · logsource: product=windows category=registry_set · 07743f65-7ec9-404a-a519-913db7118a8d
Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'
Author: Corissa Koopmans, '@corissalea'
· 2022-07-18 · logsource: product=azure service=auditlogs · 0922467f-db53-4348-b7bf-dee8d0d348c6
Monitor and alert on conditional access changes.
Author: Florent Labouyrie
· 2021-04-30 (modified 2022-10-09) · logsource: product=windows category=process_access · 174afcfa-6e40-4ae9-af64-496546389294
Detects when a process tries to access the memory of svchost to potentially dump credentials.
Author: Corissa Koopmans, '@corissalea'
· 2022-07-19 · logsource: product=azure service=auditlogs · 26e7c5e2-6545-481e-b7e6-050143459635
Monitor and alert on conditional access changes where non approved actor removed CA Policy.
Author: Milad Cheraghi
· 2026-04-28 · logsource: product=linux category=process_creation · 33b3cfb1-574e-44b9-b527-fbf9303b9d7b
Detects attempts of an attacker to enable core dumps for set-user-ID (SUID) processes by modifying the system file /proc/sys/fs/suid_dumpable, typically by setting its value to 1 or 2.
Enabling this feature allows memory dumps (core dumps) of SUID processes, which usually run with elevated privileges.
These dumps may contain sensitive information such as passwords, cryptographic keys or other secrets.
CVE-2025-5054: Information leak via core dumps from SUID binaries using apport.
CVE-2025-4598: Information disclosure in systemd-coredump due to insecure handling of SUID process memory dumps.
Author: Luc Génaux
· 2026-01-24 · logsource: product=linux category=process_creation · 3a716279-c18c-4488-83be-f9ececbfb9fc
Detects the use of the 'setcap' utility to set the 'setgid' capability (cap_setgid) on a binary file.
This capability allows a non privileged process to make arbitrary manipulations of group IDs (GIDs), including setting its current GID to a value that would otherwise be restricted (i.e. GID 0, the root group).
This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.
Author: Corissa Koopmans, '@corissalea'
· 2022-07-19 (modified 2024-05-28) · logsource: product=azure service=auditlogs · 50a3c7aa-ec29-44a4-92c1-fce229eef6fc
Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.
Author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'
· 2022-08-04 · logsource: product=azure service=auditlogs · 665e2d43-70dc-4ccc-9d27-026c9dd7ed9c
Monitor and alert on group membership removal of groups that have CA policy modification access
Author: Elastic, @SBousseaden
· 2022-04-27 (modified 2024-08-13) · logsource: product=windows service=security · 749c9f5e-b353-4b90-a9c1-05243357ca4b
Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account.
This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.
Author: Bryan Lim
· 2024-01-12 · logsource: product=gcp service=gcp.audit · 76737c19-66ee-4c07-b65a-a03301d1573d
Detects the deployment of workloads that are deployed by using the break-glass flag to override Binary Authorization controls.
Author: Florian Roth (Nextron Systems)
· 2021-05-27 (modified 2022-10-09) · logsource: product=windows category=process_creation · 883835a7-df45-43e4-bf1d-4268768afda4
Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe
Author: Austin Songer @austinsonger
· 2021-07-24 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 905d389b-b853-46d0-9d3d-dea0d3a3cd49
Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.
Author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'
· 2022-08-04 · logsource: product=azure service=auditlogs · 91c95675-1f27-46d0-bead-d1ae96b97cd3
Monitor and alert on group membership additions of groups that have CA policy modification access
Author: NVISO
· 2020-09-15 (modified 2022-12-25) · logsource: product=windows service=system · a0cb7110-edf0-47a4-9177-541a4083128a
Detects that a vulnerable Netlogon secure channel connection was allowed, which could be an indicator of CVE-2020-1472.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-07-23 · logsource: product=windows category=file_event · a7f3c891-2e4d-4b6a-9f8c-d5e2a1b04c73
Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path.
These files generally contain various user-specific registry settings and are typically located in the user's profile directory.
Staging these files outside of the standard path can be indicative of an attacker attempting to manipulate user registry settings
for persistence, privilege escalation, or dump user registry hives for credential harvesting.
Author: Austin Songer @austinsonger
· 2021-07-24 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · b45ab1d2-712f-4f01-a751-df3826969807
Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.
Author: Semanur Guneysu @semanurtg, oscd.community
· 2020-10-28 (modified 2022-11-11) · logsource: product=windows category=process_creation · d522eca2-2973-4391-a3e0-ef0374321dae
Detection of unusual child processes by different system processes
Author: Roberto Rodriguez @Cyb3rWard0g, Tim Shelton
· 2019-08-15 (modified 2022-09-18) · logsource: product=windows service=security · dae8171c-5ec6-4396-b210-8466585b53e9
Detects non-system users performing privileged operation os the SCM database
Author: Tim Rauch, Elastic (idea)
· 2022-09-27 · logsource: product=windows category=process_creation · e52cb31c-10ed-4aea-bcb7-593c9f4a315b
Detects attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in
Author: Luc Génaux
· 2026-01-24 · logsource: product=linux category=process_creation · ed447910-bc30-4575-a598-3a2e49516a7a
Detects the use of the 'setcap' utility to set the 'setuid' capability (cap_setuid) on a binary file.
This capability allows a non privileged process to make arbitrary manipulations of user IDs (UIDs), including setting its current UID to a value that would otherwise be restricted (i.e. UID 0, the root user).
This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.
Author: Austin Songer
· 2021-09-22 (modified 2022-12-18) · logsource: product=aws service=cloudtrail · f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e
Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.
Author: Pawel Mazur
· 2021-11-28 (modified 2022-12-25) · logsource: product=linux service=auditd · fe10751f-1995-40a5-aaa2-c97ccb4123fe
Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges.