216.73.217.172

T1548: T1548

View on MITRE ATT&CK The MITRE Corporation · Published 30/01/2020 14:58 · Modified 14/04/2026 11:20

Essential information

MITRE technique ID
T1548
Confidence
100/100
Revoked
No
Published
30/01/2020 14:58
Modified
14/04/2026 11:20
Author / Source
The MITRE Corporation

Aliases

Abuse Elevation Control Mechanism

Platforms

windows macos linux IaaS Office Suite Identity Provider

Description

Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.(Citation: TechNet How UAC Works)(Citation: sudo man page 2018) An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.(Citation: OSX Keydnap malware)(Citation: Fortinet Fareit)

Kill chain phases

Kill chainPhase
mitre-attack defense-evasion
mitre-attack privilege-escalation

Marking (TLP)

TLP:GREEN Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.

External references

Related entities

Intrusion sets, malware, reports, vulnerabilities, indicators and other entities linked to this technique.