{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1548","id":"T1548","name":"Abuse Elevation Control Mechanism","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1548","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"8794ef6a89f97f3a127f64cd9b49c3a4a70515ef613036d08cc9153f123ac077","description":"Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.(Citation: TechNet How UAC Works)(Citation: sudo man page 2018) An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.(Citation: OSX Keydnap malware)(Citation: Fortinet Fareit)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1548","external_id":"T1548"},{"source_name":"TechNet How UAC Works","description":"Lich, B. (2016, May 31). How User Account Control Works. Retrieved June 3, 2016.","url":"https://technet.microsoft.com/en-us/itpro/windows/keep-secure/how-user-account-control-works"},{"source_name":"OSX Keydnap malware","description":"Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware is hungry for credentials. Retrieved July 3, 2017.","url":"https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/"},{"source_name":"Fortinet Fareit","description":"Salvio, J., Joven, R. (2016, December 16). Malicious Macro Bypasses UAC to Elevate Privilege for Fareit Malware. Retrieved December 27, 2016.","url":"https://blog.fortinet.com/2016/12/16/malicious-macro-bypasses-uac-to-elevate-privilege-for-fareit-malware"},{"source_name":"sudo man page 2018","description":"Todd C. Miller. (2018). Sudo Man Page. Retrieved March 19, 2018.","url":"https://www.sudo.ws/"}],"platforms":["Linux","macOS","Windows","IaaS","Office Suite","Identity Provider"],"environments":["cloud","cloud-hosted-endpoint","identity","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1548.001","id":"T1548.001","name":"Setuid and Setgid","page":"techniques/enterprise/T1548.001/"},{"key":"enterprise/T1548.002","id":"T1548.002","name":"Bypass User Account Control","page":"techniques/enterprise/T1548.002/"},{"key":"enterprise/T1548.003","id":"T1548.003","name":"Sudo and Sudo Caching","page":"techniques/enterprise/T1548.003/"},{"key":"enterprise/T1548.004","id":"T1548.004","name":"Elevated Execution with Prompt","page":"techniques/enterprise/T1548.004/"},{"key":"enterprise/T1548.005","id":"T1548.005","name":"Temporary Elevated Cloud Access","page":"techniques/enterprise/T1548.005/"},{"key":"enterprise/T1548.006","id":"T1548.006","name":"TCC Manipulation","page":"techniques/enterprise/T1548.006/"}],"telemetry":[{"id":"DC0059","name":"File Metadata","page":"telemetry/DC0059/","kind":"attack_component","category":"Host state and inventory","description":"File attributes such as path, size, timestamps, ownership and cryptographic hash.","collection_focus":"Collect scoped file inventory/FIM metadata with hash algorithm and observation time; preserve original timestamps separately from collector time.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["path","size_bytes","sha256","owner_uid"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0059","collector":"illustrative-lab-collector","observation":{"path":"/opt/lab/demo.txt","size_bytes":64,"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","owner_uid":1000}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0088","name":"Logon Session Metadata","page":"telemetry/DC0088/","kind":"attack_component","category":"Host state and inventory","description":"Attributes of existing logon sessions and their association with accounts or hosts.","collection_focus":"Collect supported session inventory and correlate session IDs with authentication, logon and logoff events.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["session_id","account","host","session_type"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0088","collector":"illustrative-lab-collector","observation":{"session_id":"lab-session-1","account":"LAB\\analyst","host":"lab-host-1","session_type":"interactive"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0021","name":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component","category":"Application and service audit","description":"Instrumented operating-system API calls and their return values.","collection_focus":"Use an approved EDR trace or instrument the owned lab process at selected APIs. Define API name, caller, sanitized arguments and return status.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["process_id","api","path","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0034","name":"Process Metadata","page":"telemetry/DC0034/","kind":"attack_component","category":"Host state and inventory","description":"Point-in-time process properties such as owner, executable and start time.","collection_focus":"Collect read-only process inventory with PID plus start time/stable identity, command line and collection time; restrict access to potentially sensitive arguments.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["process_id","image","owner_uid","started_at"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0034","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image":"/usr/bin/sleep","owner_uid":1000,"started_at":"2026-09-27T11:59:00Z"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0010","name":"User Account Modification","page":"telemetry/DC0010/","kind":"attack_component","category":"Windows and directory audit","description":"Modification of an account attribute, policy or enabled state.","collection_focus":"Enable Audit User Account Management and retain the changed attributes and target account; correlate approved administrative requests.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"},{"name":"Active Directory domain controllers","scope":"Directory changes and authentication records; collect from the relevant controllers, not only endpoints.","source_id":"ad"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["target_account","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0010","collector":"illustrative-lab-collector","observation":{"target_account":"lab-temp","attribute":"enabled","before":false,"after":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0063","name":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component","category":"Endpoint activity","description":"Registry value changes or registry object renames.","collection_focus":"Use RegistryEvent 13 for value-set and 14 for rename; compare against intended policy and keep original type/value where available.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence."],"configuration_example":null,"required_fields":["registry_path","event_type","value_type","value"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1548","id":"T1548","name":"Abuse Elevation Control Mechanism","domain":"enterprise","platforms":["Linux","macOS","Windows","IaaS","Office Suite","Identity Provider"],"environments":["cloud","cloud-hosted-endpoint","identity","onprem"],"source_url":"https://attack.mitre.org/techniques/T1548","technique_page":"techniques/enterprise/T1548/","page":"detections/enterprise/T1548/","status":"rule_source_available","counts":{"sigma":22,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[{"id":"905d389b-b853-46d0-9d3d-dea0d3a3cd49","title":"AWS STS AssumeRole Misuse","status":"test","level":"low","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/905d389b-b853-46d0-9d3d-dea0d3a3cd49.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_sts_assumerole_misuse.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"b45ab1d2-712f-4f01-a751-df3826969807","title":"AWS STS GetSessionToken Misuse","status":"test","level":"low","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/b45ab1d2-712f-4f01-a751-df3826969807.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_sts_getsessiontoken_misuse.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e","title":"AWS Suspicious SAML Activity","status":"test","level":"medium","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_susp_saml_activity.yml","author":"Austin Songer","kind":"sigma"},{"id":"26e7c5e2-6545-481e-b7e6-050143459635","title":"CA Policy Removed by Non Approved Actor","status":"test","level":"medium","logsource":{"product":"azure","service":"auditlogs"},"data_path":"data/detection-rules/26e7c5e2-6545-481e-b7e6-050143459635.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/audit_logs/azure_aad_secops_ca_policy_removedby_bad_actor.yml","author":"Corissa Koopmans, '@corissalea'","kind":"sigma"},{"id":"50a3c7aa-ec29-44a4-92c1-fce229eef6fc","title":"CA Policy Updated by Non Approved Actor","status":"test","level":"medium","logsource":{"product":"azure","service":"auditlogs"},"data_path":"data/detection-rules/50a3c7aa-ec29-44a4-92c1-fce229eef6fc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/audit_logs/azure_aad_secops_ca_policy_updatedby_bad_actor.yml","author":"Corissa Koopmans, '@corissalea'","kind":"sigma"},{"id":"0922467f-db53-4348-b7bf-dee8d0d348c6","title":"New CA Policy by Non-approved Actor","status":"test","level":"medium","logsource":{"product":"azure","service":"auditlogs"},"data_path":"data/detection-rules/0922467f-db53-4348-b7bf-dee8d0d348c6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/audit_logs/azure_aad_secops_new_ca_policy_addedby_bad_actor.yml","author":"Corissa Koopmans, '@corissalea'","kind":"sigma"},{"id":"91c95675-1f27-46d0-bead-d1ae96b97cd3","title":"User Added To Group With CA Policy Modification Access","status":"test","level":"medium","logsource":{"product":"azure","service":"auditlogs"},"data_path":"data/detection-rules/91c95675-1f27-46d0-bead-d1ae96b97cd3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/audit_logs/azure_group_user_addition_ca_modification.yml","author":"Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'","kind":"sigma"},{"id":"665e2d43-70dc-4ccc-9d27-026c9dd7ed9c","title":"User Removed From Group With CA Policy Modification Access","status":"test","level":"medium","logsource":{"product":"azure","service":"auditlogs"},"data_path":"data/detection-rules/665e2d43-70dc-4ccc-9d27-026c9dd7ed9c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/audit_logs/azure_group_user_removal_ca_modification.yml","author":"Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'","kind":"sigma"},{"id":"76737c19-66ee-4c07-b65a-a03301d1573d","title":"GCP Break-glass Container Workload Deployed","status":"test","level":"medium","logsource":{"product":"gcp","service":"gcp.audit"},"data_path":"data/detection-rules/76737c19-66ee-4c07-b65a-a03301d1573d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/gcp/audit/gcp_breakglass_container_workload_deployed.yml","author":"Bryan Lim","kind":"sigma"},{"id":"fe10751f-1995-40a5-aaa2-c97ccb4123fe","title":"Linux Capabilities Discovery","status":"test","level":"low","logsource":{"product":"linux","service":"auditd"},"data_path":"data/detection-rules/fe10751f-1995-40a5-aaa2-c97ccb4123fe.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/execve/lnx_auditd_capabilities_discovery.yml","author":"Pawel Mazur","kind":"sigma"},{"id":"00eee2a5-fdb0-4746-a21d-e43fbdea5681","title":"Linux Doas Conf File Creation","status":"stable","level":"medium","logsource":{"product":"linux","category":"file_event"},"data_path":"data/detection-rules/00eee2a5-fdb0-4746-a21d-e43fbdea5681.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/file_event/file_event_lnx_doas_conf_creation.yml","author":"Sittikorn S, Teoderick Contreras","kind":"sigma"},{"id":"3a716279-c18c-4488-83be-f9ececbfb9fc","title":"Linux Setgid Capability Set on a Binary via Setcap Utility","status":"experimental","level":"low","logsource":{"product":"linux","category":"process_creation"},"data_path":"data/detection-rules/3a716279-c18c-4488-83be-f9ececbfb9fc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_cap_setgid.yml","author":"Luc Génaux","kind":"sigma"},{"id":"ed447910-bc30-4575-a598-3a2e49516a7a","title":"Linux Setuid Capability Set on a Binary via Setcap Utility","status":"experimental","level":"low","logsource":{"product":"linux","category":"process_creation"},"data_path":"data/detection-rules/ed447910-bc30-4575-a598-3a2e49516a7a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_cap_setuid.yml","author":"Luc Génaux","kind":"sigma"},{"id":"067d8238-7127-451c-a9ec-fa78045b618b","title":"Linux Doas Tool Execution","status":"stable","level":"low","logsource":{"product":"linux","category":"process_creation"},"data_path":"data/detection-rules/067d8238-7127-451c-a9ec-fa78045b618b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_doas_execution.yml","author":"Sittikorn S, Teoderick Contreras","kind":"sigma"},{"id":"749c9f5e-b353-4b90-a9c1-05243357ca4b","title":"Potential Privilege Escalation via Local Kerberos Relay over LDAP","status":"test","level":"high","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/749c9f5e-b353-4b90-a9c1-05243357ca4b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/account_management/win_security_susp_privesc_kerberos_relay_over_ldap.yml","author":"Elastic, @SBousseaden","kind":"sigma"},{"id":"dae8171c-5ec6-4396-b210-8466585b53e9","title":"SCM Database Privileged Operation","status":"test","level":"medium","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/dae8171c-5ec6-4396-b210-8466585b53e9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_scm_database_privileged_operation.yml","author":"Roberto Rodriguez @Cyb3rWard0g, Tim Shelton","kind":"sigma"},{"id":"a0cb7110-edf0-47a4-9177-541a4083128a","title":"Vulnerable Netlogon Secure Channel Connection Allowed","status":"test","level":"high","logsource":{"product":"windows","service":"system"},"data_path":"data/detection-rules/a0cb7110-edf0-47a4-9177-541a4083128a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/system/netlogon/win_system_vul_cve_2020_1472.yml","author":"NVISO","kind":"sigma"},{"id":"174afcfa-6e40-4ae9-af64-496546389294","title":"Credential Dumping Attempt Via Svchost","status":"test","level":"high","logsource":{"product":"windows","category":"process_access"},"data_path":"data/detection-rules/174afcfa-6e40-4ae9-af64-496546389294.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_access/proc_access_win_svchost_credential_dumping.yml","author":"Florent Labouyrie","kind":"sigma"},{"id":"883835a7-df45-43e4-bf1d-4268768afda4","title":"Regedit as Trusted Installer","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/883835a7-df45-43e4-bf1d-4268768afda4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_regedit_trustedinstaller.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"d522eca2-2973-4391-a3e0-ef0374321dae","title":"Abused Debug Privilege by Arbitrary Parent Processes","status":"test","level":"high","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/d522eca2-2973-4391-a3e0-ef0374321dae.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_abusing_debug_privilege.yml","author":"Semanur Guneysu @semanurtg, oscd.community","kind":"sigma"},{"id":"e52cb31c-10ed-4aea-bcb7-593c9f4a315b","title":"UAC Bypass via Windows Firewall Snap-In Hijack","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/e52cb31c-10ed-4aea-bcb7-593c9f4a315b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_uac_bypass_hijacking_firwall_snap_in.yml","author":"Tim Rauch, Elastic (idea)","kind":"sigma"},{"id":"07743f65-7ec9-404a-a519-913db7118a8d","title":"COM Hijack via Sdclt","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/07743f65-7ec9-404a-a519-913db7118a8d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_comhijack_sdclt.yml","author":"Omkar Gudhate","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1548-1","technique_id":"T1548","title":"T1548 Abuse Elevation Control Mechanism","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#privilege-escalation","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":85,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L85","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"d82dc4e77044b33342c9f507251f5d5b05dfc08fb859c78eb6a3b91fc5c28881","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(privilege_elevation) AND user_or_binary NOT_IN approved_elevation_list -> ALERT","log_sources":[{"title":"Windows Security Event Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#23-windows-security-event-logs"},{"title":"Linux Authentication Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#32-linux-authentication-logs"},{"title":"Process Execution Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#6-process-execution-logs"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1548-1","technique_id":"T1548","title":"Process or account invokes elevation mechanism — T1548 Abuse Elevation Control Mechanism","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#privilege-elevation","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":60,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L60","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"81a37cbaf8628735cfb8d79d5232fba38a659a63f522dc47b48561ebb3785676","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"identity, host, and elevation action.","expected_behavior":"elevation is concentrated among specific roles and tools.","deviation":"peer-group deviation, unusual transition from low to high privilege, or burst of elevation actions.","anomaly_types":[{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"},{"title":"Transition Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#61-transition-anomaly"},{"title":"Burst Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#16-burst-anomaly"}],"log_sources":[{"title":"Windows Security Event Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#23-windows-security-event-logs"},{"title":"Linux Authentication Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#32-linux-authentication-logs"}],"context_references":[{"title":"Sysdig AI-assisted cloud intrusion investigation — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/sysdig-ai-assisted-cloud-intrusion.html"},{"title":"original source","url":"https://www.sysdig.com/blog/ai-assisted-cloud-intrusion-achieves-admin-access-in-8-minutes"}]}],"anomaly_types":[{"title":"Burst Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#16-burst-anomaly"},{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"},{"title":"Transition Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#61-transition-anomaly"}],"strategies":[{"id":"DET0345","name":"Detection Strategy for Abuse Elevation Control Mechanism (T1548)","url":"https://attack.mitre.org/detectionstrategies/DET0345","stix_id":"x-mitre-detection-strategy--9646aa18-4ebf-43c8-bf4c-670063bc5ef8","relationship_id":"relationship--6c4a90f8-082b-4b90-9e8a-e0e900f94923","description":"","analytics":[{"id":"AN0975","name":"Analytic 0975","guidance":"Correlate registry modifications (e.g., UAC bypass registry keys), unusual parent-child process relationships (e.g., control.exe spawning cmd.exe), and unsigned elevated process executions with non-standard tokens or elevation flags.","url":"https://attack.mitre.org/detectionstrategies/DET0345#AN0975","platforms":["Windows"],"tuning":[{"field":"ElevatedProcessPath","description":"Paths to monitor for unsigned or unexpected elevated binaries"},{"field":"ParentProcessName","description":"Parent-child execution chains that are suspicious in the local environment"},{"field":"TimeWindow","description":"Time between registry modification and elevated process spawn"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN0975","source_url":"https://attack.mitre.org/detectionstrategies/DET0345#AN0975","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0088","component":"Logon Session Metadata","name":"WinEventLog:Security","channel":"EventCode=4672","platforms":["Windows"],"analytic_id":"AN0975","source_url":"https://attack.mitre.org/detectionstrategies/DET0345#AN0975","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0088/"},{"component_id":"DC0063","component":"Windows Registry Key Modification","name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","platforms":["Windows"],"analytic_id":"AN0975","source_url":"https://attack.mitre.org/detectionstrategies/DET0345#AN0975","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0063/"}]},{"id":"AN0976","name":"Analytic 0976","guidance":"Monitor audit logs for setuid/setgid bit changes, executions where UID ≠ EUID (indicative of sudo or privilege escalation), and high-integrity binaries launched by unprivileged users.","url":"https://attack.mitre.org/detectionstrategies/DET0345#AN0976","platforms":["Linux"],"tuning":[{"field":"WatchedDirectories","description":"Paths where unauthorized setuid binaries may be dropped"},{"field":"UserContext","description":"Which users are allowed to run sudo/pkexec or modify binaries"},{"field":"TimeWindow","description":"Duration between file permission change and elevated command execution"}],"log_sources":[{"component_id":"DC0059","component":"File Metadata","name":"auditd:SYSCALL","channel":"setuid or setgid bit changes","platforms":["Linux"],"analytic_id":"AN0976","source_url":"https://attack.mitre.org/detectionstrategies/DET0345#AN0976","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0059/"},{"component_id":"DC0034","component":"Process Metadata","name":"auditd:SYSCALL","channel":"execve with UID ≠ EUID","platforms":["Linux"],"analytic_id":"AN0976","source_url":"https://attack.mitre.org/detectionstrategies/DET0345#AN0976","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0034/"},{"component_id":"DC0021","component":"OS API Execution","name":"auditd:SYSCALL","channel":"sudo or pkexec invocation","platforms":["Linux"],"analytic_id":"AN0976","source_url":"https://attack.mitre.org/detectionstrategies/DET0345#AN0976","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0021/"}]},{"id":"AN0977","name":"Analytic 0977","guidance":"Detect execution of `/usr/libexec/security_authtrampoline` or use of AuthorizationExecuteWithPrivileges API, and monitor process lineage for unusual launches of GUI apps with escalated privileges.","url":"https://attack.mitre.org/detectionstrategies/DET0345#AN0977","platforms":["macOS"],"tuning":[{"field":"WatchedBinaries","description":"Specify binaries frequently targeted for privilege escalation"},{"field":"ExecutionParent","description":"Which applications should never be allowed to spawn elevated processes"}],"log_sources":[{"component_id":"DC0021","component":"OS API Execution","name":"macos:unifiedlog","channel":"authorization execute privilege requests","platforms":["macOS"],"analytic_id":"AN0977","source_url":"https://attack.mitre.org/detectionstrategies/DET0345#AN0977","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0021/"},{"component_id":"DC0034","component":"Process Metadata","name":"auditd:SYSCALL","channel":"execve with escalated privileges","platforms":["macOS"],"analytic_id":"AN0977","source_url":"https://attack.mitre.org/detectionstrategies/DET0345#AN0977","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0034/"},{"component_id":"DC0032","component":"Process Creation","name":"fs:fsusage","channel":"binary execution of security_authtrampoline","platforms":["macOS"],"analytic_id":"AN0977","source_url":"https://attack.mitre.org/detectionstrategies/DET0345#AN0977","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0978","name":"Analytic 0978","guidance":"Monitor for unexpected privilege elevation operations via SAML assertion manipulation, role injection, or changes to identity mappings that result in access escalation.","url":"https://attack.mitre.org/detectionstrategies/DET0345#AN0978","platforms":["Identity Provider"],"tuning":[{"field":"AuthorizedRoleMappings","description":"Roles or groups that should never be assumed outside designated paths"},{"field":"TimeWindow","description":"Time between assertion issuance and critical privilege use"}],"log_sources":[{"component_id":"DC0010","component":"User Account Modification","name":"azure:signinlogs","channel":"unusual role assumption or elevation path","platforms":["Identity Provider"],"analytic_id":"AN0978","source_url":"https://attack.mitre.org/detectionstrategies/DET0345#AN0978","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0010/"}]},{"id":"AN0979","name":"Analytic 0979","guidance":"Detect sudden privilege escalations such as IAM role changes, user-assigned privilege boundaries, or elevation via assumed roles beyond normal behavior.","url":"https://attack.mitre.org/detectionstrategies/DET0345#AN0979","platforms":["IaaS"],"tuning":[{"field":"PermittedRoleTransitions","description":"Define valid transitions between IAM roles"},{"field":"CrossAccountBoundary","description":"Should flag if assumption crosses trust boundary"}],"log_sources":[{"component_id":"DC0010","component":"User Account Modification","name":"AWS:CloudTrail","channel":"role privilege expansion detected","platforms":["IaaS"],"analytic_id":"AN0979","source_url":"https://attack.mitre.org/detectionstrategies/DET0345#AN0979","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0010/"},{"component_id":"DC0034","component":"Process Metadata","name":"AWS:CloudTrail","channel":"cross-account or unexpected assume role","platforms":["IaaS"],"analytic_id":"AN0979","source_url":"https://attack.mitre.org/detectionstrategies/DET0345#AN0979","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0034/"}]}]}],"telemetry_references":[{"id":"DC0059","name":"File Metadata","tag":"File Metadata","page":"telemetry/DC0059/","kind":"attack_component"},{"id":"DC0088","name":"Logon Session Metadata","tag":"Logon Session Metadata","page":"telemetry/DC0088/","kind":"attack_component"},{"id":"DC0021","name":"OS API Execution","tag":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0034","name":"Process Metadata","tag":"Process Metadata","page":"telemetry/DC0034/","kind":"attack_component"},{"id":"DC0010","name":"User Account Modification","tag":"User Account Modification","page":"telemetry/DC0010/","kind":"attack_component"},{"id":"DC0063","name":"Windows Registry Key Modification","tag":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S1130","name":"Raspberry Robin","url":"https://attack.mitre.org/software/S1130","kind":"malware","description":"[Raspberry Robin](https://attack.mitre.org/software/S1130) implements a variation of the <code>ucmDccwCOMMethod</code> technique abusing the Windows AutoElevate backdoor to bypass UAC while elevating privileges.(Citation: TrendMicro RaspberryRobin 2022)","relationship_id":"relationship--9f30368d-3656-4ba1-8e53-94d5721f9241","references":[{"source_name":"TrendMicro RaspberryRobin 2022","description":"Christopher So. (2022, December 20). Raspberry Robin Malware Targets Telecom, Governments. Retrieved May 17, 2024.","url":"https://www.trendmicro.com/en_us/research/22/l/raspberry-robin-malware-targets-telecom-governments.html"}]}],"actors":[{"id":"G1048","name":"UNC3886","url":"https://attack.mitre.org/groups/G1048","kind":"intrusion-set","description":" [UNC3886](https://attack.mitre.org/groups/G1048) has used vSphere Installation Bundles (VIBs) that contained modified descriptor XML files with the `acceptance-level` set to `partner` which allowed for privilege escalation.(Citation: Google Cloud Threat Intelligence ESXi VIBs 2022)","relationship_id":"relationship--650b58f8-3968-420f-94c2-6173fbc600c6","references":[{"source_name":"Google Cloud Threat Intelligence ESXi VIBs 2022","description":"Alexander Marvi, Jeremy Koppen, Tufail Ahmed, and Jonathan Lepore. (2022, September 29). Bad VIB(E)s Part One: Investigating Novel Malware Persistence Within ESXi Hypervisors. Retrieved March 26, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence"}]}],"mitigations":[{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Limit the privileges of cloud accounts to assume, create, or impersonate additional roles, policies, and permissions to only those required. Where just-in-time access is enabled, consider requiring manual approval for temporary elevation of privileges.","relationship_id":"relationship--8052b9cf-2e89-49c4-a294-4ee42c6c6e03","references":[]},{"id":"M1022","name":"Restrict File and Directory Permissions","url":"https://attack.mitre.org/mitigations/M1022","kind":"course-of-action","description":"The sudoers file should be strictly edited such that passwords are always required and that users can't spawn risky processes as users with higher privilege.","relationship_id":"relationship--b12a23ae-65f6-4226-8124-331ad59d1556","references":[]},{"id":"M1026","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M1026","kind":"course-of-action","description":"Remove users from the local administrator group on systems.\n\nBy requiring a password, even if an adversary can get terminal access, they must know the password to run anything in the sudoers file. Setting the timestamp_timeout to 0 will require the user to input their password every time sudo is executed.","relationship_id":"relationship--7e024389-346c-489b-a406-1bbdec150eda","references":[]},{"id":"M1028","name":"Operating System Configuration","url":"https://attack.mitre.org/mitigations/M1028","kind":"course-of-action","description":"Applications with known vulnerabilities or known shell escapes should not have the setuid or setgid bits set to reduce potential damage if an application is compromised. Additionally, the number of programs with setuid or setgid bits set should be minimized across a system. Ensuring that the sudo tty_tickets setting is enabled will prevent this leakage across tty sessions.","relationship_id":"relationship--540937b6-1afd-4f8b-8deb-c1c4f6456ce7","references":[]},{"id":"M1038","name":"Execution Prevention","url":"https://attack.mitre.org/mitigations/M1038","kind":"course-of-action","description":"System settings can prevent applications from running that haven't been downloaded from legitimate repositories which may help mitigate some of these issues. Not allowing unsigned applications from being run may also mitigate some risk.","relationship_id":"relationship--35428082-1010-4e0e-ac4c-9f1426de7796","references":[]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Check for common UAC bypass weaknesses on Windows systems to be aware of the risk posture and address issues where appropriate.(Citation: Github UACMe)","relationship_id":"relationship--94d71c18-e2af-4dfd-aa2f-28ca68a772ab","references":[{"source_name":"Github UACMe","description":"UACME Project. (2016, June 16). UACMe. Retrieved July 26, 2016.","url":"https://github.com/hfiref0x/UACME"}]},{"id":"M1051","name":"Update Software","url":"https://attack.mitre.org/mitigations/M1051","kind":"course-of-action","description":"Perform regular software updates to mitigate exploitation risk.","relationship_id":"relationship--58d61052-a04e-4c13-bdd4-a0847956ba70","references":[]},{"id":"M1052","name":"User Account Control","url":"https://attack.mitre.org/mitigations/M1052","kind":"course-of-action","description":"Although UAC bypass techniques exist, it is still prudent to use the highest enforcement level for UAC when possible and mitigate bypass opportunities that exist with techniques such as [DLL](https://attack.mitre.org/techniques/T1574/001).","relationship_id":"relationship--6928abb5-b9b1-48d5-b3c5-8c7a94da5076","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1548":"/ttp-simulation/techniques/enterprise/T1548/","T1574.001":"/ttp-simulation/techniques/enterprise/T1574.001/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1548","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0059","collector":"illustrative-lab-collector","observation":{"path":"/opt/lab/demo.txt","size_bytes":64,"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","owner_uid":1000}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0088","collector":"illustrative-lab-collector","observation":{"session_id":"lab-session-1","account":"LAB\\analyst","host":"lab-host-1","session_type":"interactive"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0034","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image":"/usr/bin/sleep","owner_uid":1000,"started_at":"2026-09-27T11:59:00Z"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0010","collector":"illustrative-lab-collector","observation":{"target_account":"lab-temp","attribute":"enabled","before":false,"after":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}}]}}