Description
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.(Citation: TechNet How UAC Works)(Citation: sudo man page 2018) An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.(Citation: OSX Keydnap malware)(Citation: Fortinet Fareit)
Platforms
Sub-Techniques (6)
Setuid and Setgid
T1548.002Bypass User Account Control
T1548.003Sudo and Sudo Caching
T1548.004Elevated Execution with Prompt
T1548.005Temporary Elevated Cloud Access
T1548.006TCC Manipulation
Mitigations (8)
Execution PreventionM1038
System settings can prevent applications from running that haven't been downloaded from legitimate repositories which may help mitigate some of these issues. Not allowing unsigned applications from being run may also mitigate some risk.
Operating System ConfigurationM1028
Applications with known vulnerabilities or known shell escapes should not have the setuid or setgid bits set to reduce potential damage if an application is compromised. Additionally, the number of programs with setuid or setgid bits set should be minimized across a system. Ensuring that the sudo tty_tickets setting is enabled will prevent this leakage across tty sessions.
Update SoftwareM1051
Perform regular software updates to mitigate exploitation risk.
User Account ControlM1052
Although UAC bypass techniques exist, it is still prudent to use the highest enforcement level for UAC when possible and mitigate bypass opportunities that exist with techniques such as DLL.
Privileged Account ManagementM1026
Remove users from the local administrator group on systems.
By requiring a password, even if an adversary can get terminal access, they must know the password to run anything in the sudoers file. Setting the timestamp_timeout to 0 will require the user to input their password every time sudo is executed.
User Account ManagementM1018
Limit the privileges of cloud accounts to assume, create, or impersonate additional roles, policies, and permissions to only those required. Where just-in-time access is enabled, consider requiring manual approval for temporary elevation of privileges.
AuditM1047
Check for common UAC bypass weaknesses on Windows systems to be aware of the risk posture and address issues where appropriate.(Citation: Github UACMe)
Restrict File and Directory PermissionsM1022
The sudoers file should be strictly edited such that passwords are always required and that users can't spawn risky processes as users with higher privilege.
Threat Groups (1)
| ID | Group | Context |
|---|---|---|
| G1048 | UNC3886 | [UNC3886](https://attack.mitre.org/groups/G1048) has used vSphere Installation Bundles (VIBs) that contained modified descriptor XML files with the `... |
Associated Software (1)
| ID | Name | Type | Context |
|---|---|---|---|
| S1130 | Raspberry Robin | Malware | [Raspberry Robin](https://attack.mitre.org/software/S1130) implements a variation of the <code>ucmDccwCOMMethod</code> technique abusing the Windows A... |
References
- Lich, B. (2016, May 31). How User Account Control Works. Retrieved June 3, 2016.
- Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware is hungry for credentials. Retrieved July 3, 2017.
- Salvio, J., Joven, R. (2016, December 16). Malicious Macro Bypasses UAC to Elevate Privilege for Fareit Malware. Retrieved December 27, 2016.
- Todd C. Miller. (2018). Sudo Man Page. Retrieved March 19, 2018.
Frequently Asked Questions
What is T1548 (Abuse Elevation Control Mechanism)?
T1548 is a MITRE ATT&CK technique named 'Abuse Elevation Control Mechanism'. It belongs to the Privilege Escalation tactic(s). Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to lim...
How can T1548 be detected?
Detection of T1548 (Abuse Elevation Control Mechanism) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1548?
There are 8 documented mitigations for T1548. Key mitigations include: Execution Prevention, Operating System Configuration, Update Software, User Account Control, Privileged Account Management.
Which threat groups use T1548?
Known threat groups using T1548 include: UNC3886.