T1548 Abuse Elevation Control Mechanism
Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Mitigations
| ID |
Mitigation |
Description |
| M1047 |
Audit |
Check for common UAC bypass weaknesses on Windows systems to be aware of the risk posture and address issues where appropriate. |
| M1038 |
Execution Prevention |
System settings can prevent applications from running that haven’t been downloaded from legitimate repositories which may help mitigate some of these issues. Not allowing unsigned applications from being run may also mitigate some risk. |
| M1028 |
Operating System Configuration |
Applications with known vulnerabilities or known shell escapes should not have the setuid or setgid bits set to reduce potential damage if an application is compromised. Additionally, the number of programs with setuid or setgid bits set should be minimized across a system. Ensuring that the sudo tty_tickets setting is enabled will prevent this leakage across tty sessions. |
| M1026 |
Privileged Account Management |
Remove users from the local administrator group on systems. |
| M1022 |
Restrict File and Directory Permissions |
The sudoers file should be strictly edited such that passwords are always required and that users can’t spawn risky processes as users with higher privilege. |
| M1052 |
User Account Control |
Although UAC bypass techniques exist, it is still prudent to use the highest enforcement level for UAC when possible and mitigate bypass opportunities that exist with techniques such as DLL Search Order Hijacking. |
Detection
References