Skip to content

T1548.004 Elevated Execution with Prompt

Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials.1 The purpose of this API is to give application developers an easy way to perform operations with root privileges, such as for application installation or updating. This API does not validate that the program requesting root privileges comes from a reputable source or has been maliciously modified.

Although this API is deprecated, it still fully functions in the latest releases of macOS. When calling this API, the user will be prompted to enter their credentials but no checks on the origin or integrity of the program are made. The program calling the API may also load world writable files which can be modified to perform malicious behavior with elevated privileges.

Adversaries may abuse AuthorizationExecuteWithPrivileges to obtain root privileges in order to install malicious software on victims and install persistence mechanisms.324 This technique may be combined with Masquerading to trick the user into granting escalated privileges to malicious code.32 This technique has also been shown to work by modifying legitimate programs present on the machine that make use of this API.3

Item Value
ID T1548.004
Sub-techniques T1548.001, T1548.002, T1548.003, T1548.004
Tactics TA0004, TA0005
Platforms macOS
Permissions required Administrator, User
Version 1.0
Created 30 January 2020
Last Modified 19 October 2022

Procedure Examples

ID Name Description
S0402 OSX/Shlayer OSX/Shlayer can escalate privileges to root by asking the user for credentials.2


ID Mitigation Description
M1038 Execution Prevention System settings can prevent applications from running that haven’t been downloaded through the Apple Store which may help mitigate some of these issues. Not allowing unsigned applications from being run may also mitigate some risk.


ID Data Source Data Component
DS0009 Process OS API Execution