// MITRE ATT&CK
T1548 · Abuse Elevation Control Mechanism
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific user...
¿Cómo detectarlo y mitigarlo?
La detección de Abuse Elevation Control Mechanism parte de la telemetría de tu SIEM/EDR. Escribe una regla de detección con el generador Sigma, analiza logs sospechosos en el analizador de logs y sitúa la técnica en tu cobertura con la matriz ATT&CK.
Sub-técnicas (6)
T1548.001
Setuid and Setgid T1548.002
Bypass User Account Control T1548.003
Sudo and Sudo Caching T1548.004
Elevated Execution with Prompt T1548.005
Temporary Elevated Cloud Access T1548.006
TCC Manipulation
Setuid and Setgid T1548.002
Bypass User Account Control T1548.003
Sudo and Sudo Caching T1548.004
Elevated Execution with Prompt T1548.005
Temporary Elevated Cloud Access T1548.006
TCC Manipulation
Técnicas relacionadas
T1546.013
PowerShell Profile T1546.006
LC_LOAD_DYLIB Addition T1548.002
Bypass User Account Control T1548.003
Sudo and Sudo Caching T1546.011
Application Shimming T1611
Escape to Host T1546.005
Trap T1548.001
Setuid and Setgid
PowerShell Profile T1546.006
LC_LOAD_DYLIB Addition T1548.002
Bypass User Account Control T1548.003
Sudo and Sudo Caching T1546.011
Application Shimming T1611
Escape to Host T1546.005
Trap T1548.001
Setuid and Setgid
Fuente: MITRE ATT&CK®. ATT&CK es una marca registrada de The MITRE Corporation. Contenido con fines educativos.