Abuse Elevation Control Mechanism: A Defender's Guide (T1548)

Every modern system has a way to say "this user may do this risky thing, but only under these conditions." Windows has User Account Control. Unix has setuid and sudo. macOS has authorization prompts and privacy controls. Cloud platforms have role elevation. MITRE groups attacks on all of these as T1548, Abuse Elevation Control Mechanism, a Privilege Escalation technique.

The platforms MITRE lists are Linux, macOS, Windows, IaaS, Office Suite and Identity Provider. The breadth is the point: the mechanism differs, but the question for a defender is the same. Who can elevate, how, and would we notice if the wrong party did?

How attackers use it

MITRE describes the general idea this way: adversaries circumvent the mechanisms meant to control privilege elevation to gain higher-level permissions. Authorization has to be granted to specific users for tasks that carry more risk, and an adversary takes advantage of built-in control mechanisms to escalate.

The technique has sub-techniques for each family of mechanism.

• Setuid and Setgid (T1548.001), where a binary runs as its owner.
• Bypass User Account Control (T1548.002), on Windows.
• Sudo and Sudo Caching (T1548.003), on Linux and macOS.
• Elevated Execution with Prompt (T1548.004), on macOS.
• Temporary Elevated Cloud Access (T1548.005), in IaaS, Office Suite and identity providers.
• TCC Manipulation (T1548.006), on macOS.

Each one gets its own post in this series. This post is the map across them.

How to detect it

MITRE's detection strategy for the parent technique has an analytic for each platform family.

• Windows: correlate registry changes such as UAC bypass keys, unusual parent and child process relationships (for example control.exe spawning cmd.exe), and unsigned elevated processes that run with non-standard tokens or elevation flags.
• Linux and macOS: monitor audit logs for setuid and setgid bit changes, for executions where the user ID differs from the effective user ID (a sign of sudo or privilege escalation), and for high-integrity binaries launched by unprivileged users.
• macOS prompts: detect execution of /usr/libexec/security_authtrampoline or use of the AuthorizationExecuteWithPrivileges API, and watch process lineage for unusual launches of GUI apps with escalated privileges.
• Identity providers: monitor for unexpected elevation through SAML assertion manipulation, role injection, or changes to identity mappings that result in escalated access.
• Cloud: detect sudden privilege changes such as IAM role changes, user-assigned privilege boundaries, or elevation through assumed roles beyond the normal pattern.

What these have in common is a baseline. Each analytic compares an elevation event with what is normal for that account, host or role.

How to reduce the risk

MITRE lists many mitigations for the parent technique, and they map neatly onto the platforms.

• Audit: check for common UAC bypass weaknesses on Windows so you know your risk posture.
• Execution Prevention: system settings can block applications that were not downloaded from legitimate repositories, and refusing unsigned applications reduces risk.
• Operating System Configuration: do not set setuid or setgid on applications with known vulnerabilities or shell escapes, and keep the number of such programs minimal. Keep the sudo tty_tickets setting enabled to prevent leakage across terminal sessions.
• Privileged Account Management: remove users from the local administrator group. Require a password for sudo, and consider setting timestamp_timeout to 0 so it is asked for every time.
• Restrict File and Directory Permissions: edit sudoers so that passwords are always required and users cannot start risky processes as more privileged users.
• Update Software: patch regularly to cut exploitation risk.
• User Account Control: use the highest UAC enforcement level where possible, and close bypass opportunities such as DLL planting.
• User Account Management: limit the privileges of cloud accounts to assume, create or impersonate roles to only those required. Where just-in-time access exists, consider manual approval for temporary elevation.

Check your own environment

A short cross-platform checklist.

• Windows: is UAC enabled, and at what level? Who is in the local Administrators group on a typical workstation?
• Linux and macOS: how many setuid binaries are on your base image, and does the list match a recorded baseline? Are there NOPASSWD lines in sudoers?
• macOS: is SIP enabled, and is Full Disk Access limited to the binaries that need it?
• Cloud: which principals can assume, pass or impersonate roles, and do any of those roles carry broad administrative rights?

Each sub-technique post has read-only commands for its own platform.

Quick check

Sources

• MITRE ATT&CK, Abuse Elevation Control Mechanism: https://attack.mitre.org/techniques/T1548