T1548 Abuse Elevation Control Mechanism

Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. MITRE ATT&CK

3 programs on CmdID 7 Sigma rules T1548 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK

T1548.001Abuse Elevation Control Mechanism: Setuid and Setgid

T1548.002Abuse Elevation Control Mechanism: Bypass User Account Control

T1548.003Abuse Elevation Control Mechanism: Sudo and Sudo Caching

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

highAbused Debug Privilege by Arbitrary Parent ProcessesSemanur Guneysu @semanurtg, oscd.community · Windows

highRegedit as Trusted InstallerFlorian Roth (Nextron Systems) · Windows

lowLinux Doas Tool ExecutionSittikorn S, Teoderick Contreras · Linux

everyday examples from tldr-pages, CC BY 4.0

Run a command as root on the page for doas

doas commandIdentify

Run a command as another user on the page for doas

doas -u user commandIdentify

Launch the default shell as root on the page for doas

doas -sIdentify

Set a specific login shell for the current user on the page for chpass

doas chpass -s path/to/shellIdentify

Set a login shell for a specific user on the page for chpass

doas chpass -s path/to/shell usernameIdentify

Specify a user database entry in the passwd file format on the page for chpass

doas chpass -a username:encrypted_password:uid:gid:...Identify

An example is here when CmdID’s reading of it names T1548: a Sigma rule it trips is tagged with it, or its abuse is documented as it.