1200KM / detection
T1548.004 Elevated Execution with Prompt — Detection Rules
Detection workspace for T1548.004 Elevated Execution with Prompt: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0395 macOS AuthorizationExecuteWithPrivileges Elevation Prompt Detection
AN1111 Analytic 1111
Detects abuse of AuthorizationExecuteWithPrivileges API to gain elevated privileges via user credential prompts, typically through invocation of /usr/libexec/security_authtrampoline. Detection involves correlation of API usage, binary reputation, and prompt context.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1548.004 simulation workspace
No reviewed association in this snapshot.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.