T1548 Abuse Elevation Control Mechanism
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.(Citation: TechNet How UAC…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- HackTool - Empire PowerShell UAC Bypasscriticalstable · windows
- Sudo Privilege Escalation CVE-2019-14287 - Builtincriticaltest · linux
- TrustedPath UAC Bypass Patterncriticaltest · windows
- CMSTP UAC Bypass via COM Object Accesshighstable · windows
- Abused Debug Privilege by Arbitrary Parent Processeshightest · windows
- Bypass UAC Using DelegateExecutehightest · windows
- Bypass UAC Using SilentCleanup Taskhightest · windows
- Bypass UAC via CMSTPhightest · windows
- Bypass UAC via Fodhelper.exehightest · windows
- Bypass UAC via WSReset.exehightest · windows
- COM Hijack via Sdclthightest · windows
- Credential Dumping Attempt Via Svchosthightest · windows
- Explorer NOUACCHECK Flaghightest · windows
- HackTool - UACMe Akagi Executionhightest · windows
- HackTool - WinPwn Executionhightest · windows
- HackTool - WinPwn Execution - ScriptBlockhightest · windows
- Potential Privilege Escalation via Local Kerberos Relay over LDAPhightest · windows
- Potentially Suspicious Event Viewer Child Processhightest · windows
- PowerShell Web Access Feature Enabled Via DISMhightest · windows
- PwnKit Local Privilege Escalationhightest · linux
- Regedit as Trusted Installerhightest · windows
- Shell Open Registry Keys Manipulationhightest · windows
- Sudo Privilege Escalation CVE-2019-14287hightest · linux
- UAC Bypass Abusing Winsat Path Parsing - Filehightest · windows
- UAC Bypass Abusing Winsat Path Parsing - Processhightest · windows
Showing 25 of 61.
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.