Skip to content

T1548 Abuse Elevation Control Mechanism

Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.14 An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.23

Item Value
ID T1548
Sub-techniques T1548.001, T1548.002, T1548.003, T1548.004, T1548.005, T1548.006
Tactics TA0004, TA0005
Platforms IaaS, Identity Provider, Linux, Office Suite, Windows, macOS
Version 1.5
Created 30 January 2020
Last Modified 24 October 2025

Procedure Examples

ID Name Description
S1130 Raspberry Robin Raspberry Robin implements a variation of the ucmDccwCOMMethod technique abusing the Windows AutoElevate backdoor to bypass UAC while elevating privileges.6
G1048 UNC3886 UNC3886 has used vSphere Installation Bundles (VIBs) that contained modified descriptor XML files with the acceptance-level set to partner which allowed for privilege escalation.7

Mitigations

ID Mitigation Description
M1047 Audit Check for common UAC bypass weaknesses on Windows systems to be aware of the risk posture and address issues where appropriate.5
M1038 Execution Prevention System settings can prevent applications from running that haven’t been downloaded from legitimate repositories which may help mitigate some of these issues. Not allowing unsigned applications from being run may also mitigate some risk.
M1028 Operating System Configuration Applications with known vulnerabilities or known shell escapes should not have the setuid or setgid bits set to reduce potential damage if an application is compromised. Additionally, the number of programs with setuid or setgid bits set should be minimized across a system. Ensuring that the sudo tty_tickets setting is enabled will prevent this leakage across tty sessions.
M1026 Privileged Account Management Remove users from the local administrator group on systems.
M1022 Restrict File and Directory Permissions The sudoers file should be strictly edited such that passwords are always required and that users can’t spawn risky processes as users with higher privilege.
M1051 Update Software Perform regular software updates to mitigate exploitation risk.
M1052 User Account Control Although UAC bypass techniques exist, it is still prudent to use the highest enforcement level for UAC when possible and mitigate bypass opportunities that exist with techniques such as DLL.
M1018 User Account Management Limit the privileges of cloud accounts to assume, create, or impersonate additional roles, policies, and permissions to only those required. Where just-in-time access is enabled, consider requiring manual approval for temporary elevation of privileges.

References

  1. Lich, B. (2016, May 31). How User Account Control Works. Retrieved June 3, 2016. ↩

  2. Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware is hungry for credentials. Retrieved July 3, 2017. ↩

  3. Salvio, J., Joven, R. (2016, December 16). Malicious Macro Bypasses UAC to Elevate Privilege for Fareit Malware. Retrieved December 27, 2016. ↩

  4. Todd C. Miller. (2018). Sudo Man Page. Retrieved March 19, 2018. ↩

  5. UACME Project. (2016, June 16). UACMe. Retrieved July 26, 2016. ↩

  6. Christopher So. (2022, December 20). Raspberry Robin Malware Targets Telecom, Governments. Retrieved May 17, 2024. ↩

  7. Alexander Marvi, Jeremy Koppen, Tufail Ahmed, and Jonathan Lepore. (2022, September 29). Bad VIB(E)s Part One: Investigating Novel Malware Persistence Within ESXi Hypervisors. Retrieved March 26, 2025. ↩