TA0004 · PRIVILEGE ESCALATION
Abuse Elevation Control Mechanism
UAC bypasses, sudo abuse, setuid binaries, and elevated COM interfaces.
Detect it with
fodhelper.exe / computerdefaults.exe registry hijacks; sudo invocations by service accounts.
Why it matters on shift
Abuse Elevation Control Mechanism is one of the concrete ways adversaries achieve privilege escalation. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After privilege escalation, the next tactic is usually Defense Evasion. Search your telemetry for the transition before closing the ticket.
6 sub-techniques
How it shows up in practice
- T1548.001
Setuid and Setgid
An adversary may abuse configurations where an application has the setuid or setgid bits set in order to get code running in a different (and possibly more privileged) user’s context.
- T1548.002
Bypass User Account Control
Adversaries may bypass UAC mechanisms to elevate process privileges on system.
- T1548.003
Sudo and Sudo Caching
Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges.
- T1548.004
Elevated Execution with Prompt
Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials.
- T1548.005
Temporary Elevated Cloud Access
Adversaries may abuse permission configurations that allow them to gain temporarily elevated access to cloud resources.
- T1548.006
TCC Manipulation
Adversaries can manipulate or abuse the Transparency, Consent, & Control (TCC) service or database to grant malicious executables elevated permissions.
Kill-chain context