Automation · API / MCP 中文

Technique note · T1548

Abuse Elevation Control Mechanism

Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.

ATT&CK T1548 platforms — Status Active Version 20.1

Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.12 An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.34

  1. TechNet How UAC Works
  2. sudo man page 2018
  3. OSX Keydnap malware
  4. Fortinet Fareit

Groups using this technique

GroupNameCountry
grp_g1048UNC3886—

Claims

No public claim points at this technique yet.

Auto-ingested and not human-reviewed; confidence and validity read by citation.