T1548 - Abuse Elevation Control Mechanism

Tactics:
Privilege Escalation Defense Evasion
Platforms:
Linux macOS Windows IaaS +2
Detection:
Not specified
Description:
Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.(Citation: TechNet How UAC Works)(Citation: sudo man page 2018) An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.(Citation: OSX Keydnap malware)(Citation: Fortinet Fareit)
Sub-techniques (6)
ID ATT&CK Actions
T1548.001 Setuid and Setgid
T1548.002 Bypass User Account Control
T1548.003 Sudo and Sudo Caching
T1548.004 Elevated Execution with Prompt
T1548.005 Temporary Elevated Cloud Access
T1548.006 TCC Manipulation
Used by Actors (1)
Metadata
MITRE ID: T1548
STIX ID: attack-pattern--67720091-eee3-...
Platforms: Linux, macOS, Windows, IaaS, Office Suite, Identity Provider
Created: 13/01/2026 17:48
Updated: 14/03/2026 04:00