T1548 Abuse Elevation Control Mechanism — ATT&CK Technique
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Detection coverage (30)
- Potential Exploitation of CVE-2025-5054 or CVE-2025-4598 medium
- AWS Suspicious SAML Activity medium
- AWS STS AssumeRole Misuse low
- AWS STS GetSessionToken Misuse low
- CA Policy Updated by Non Approved Actor medium
- CA Policy Removed by Non Approved Actor medium
- New CA Policy by Non-approved Actor medium
- User Removed From Group With CA Policy Modification Access medium
- User Added To Group With CA Policy Modification Access medium
- GCP Break-glass Container Workload Deployed medium
- Linux Capabilities Discovery low
- Linux Doas Conf File Creation medium
- Linux Setgid Capability Set on a Binary via Setcap Utility low
- Linux Doas Tool Execution low
- Linux Setuid Capability Set on a Binary via Setcap Utility low
- Potential Privilege Escalation via Local Kerberos Relay over LDAP high
- SCM Database Privileged Operation medium
- Regedit as Trusted Installer high
- Vulnerable Netlogon Secure Channel Connection Allowed high
- Credential Dumping Attempt Via Svchost high
- Abused Debug Privilege by Arbitrary Parent Processes high
- UAC Bypass via Windows Firewall Snap-In Hijack medium
- COM Hijack via Sdclt high
- Allow Operation with Consent Admin
- Linux Persistence and Privilege Escalation Risk Behavior
- Linux Telnet Authentication Bypass
- Services Escalate Exe
- Windows Privilege Escalation User Process Spawn System Process
- Windows Privilege Escalation System Process Without System Parent
- Windows Privilege Escalation Suspicious Process Elevation