some_candidates_require_elevation — constraint tag

Meaning and evidence boundary

Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.

Related pages

• T1001.002 Steganography · simulation
• T1003 OS Credential Dumping · simulation
• T1003.001 LSASS Memory · simulation
• T1003.002 Security Account Manager · simulation
• T1003.003 NTDS · simulation
• T1003.004 LSA Secrets · simulation
• T1003.007 Proc Filesystem · simulation
• T1003.008 /etc/passwd and /etc/shadow · simulation
• T1006 Direct Volume Access · simulation
• T1007 System Service Discovery · simulation
• T1012 Query Registry · simulation
• T1014 Rootkit · simulation
• T1016 System Network Configuration Discovery · simulation
• T1018 Remote System Discovery · simulation
• T1021.001 Remote Desktop Protocol · simulation
• T1021.002 SMB/Windows Admin Shares · simulation
• T1021.005 VNC · simulation
• T1021.006 Windows Remote Management · simulation
• T1027 Obfuscated Files or Information · simulation
• T1027.007 Dynamic API Resolution · simulation
• T1027.013 Encrypted/Encoded File · simulation
• T1036.003 Rename Legitimate Utilities · simulation
• T1036.004 Masquerade Task or Service · simulation
• T1036.005 Match Legitimate Resource Name or Location · simulation
• T1037.004 RC Scripts · simulation
• T1037.005 Startup Items · simulation
• T1039 Data from Network Shared Drive · simulation
• T1040 Network Sniffing · simulation
• T1046 Network Service Discovery · simulation
• T1047 Windows Management Instrumentation · simulation
• T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol · simulation
• T1049 System Network Connections Discovery · simulation
• T1053.003 Cron · simulation
• T1053.005 Scheduled Task · simulation
• T1053.006 Systemd Timers · simulation
• T1055 Process Injection · simulation
• T1055.001 Dynamic-link Library Injection · simulation
• T1055.002 Portable Executable Injection · simulation
• T1055.015 ListPlanting · simulation
• T1056.001 Keylogging · simulation
• T1056.004 Credential API Hooking · simulation
• T1057 Process Discovery · simulation
• T1059.001 PowerShell · simulation
• T1059.003 Windows Command Shell · simulation
• T1059.004 Unix Shell · simulation
• T1068 Exploitation for Privilege Escalation · simulation
• T1069.002 Domain Groups · simulation
• T1070 Indicator Removal · simulation
• T1070.003 Clear Command History · simulation
• T1070.004 File Deletion · simulation
• T1070.005 Network Share Connection Removal · simulation
• T1070.006 Timestomp · simulation
• T1070.008 Clear Mailbox Data · simulation
• T1072 Software Deployment Tools · simulation
• T1078.001 Default Accounts · simulation
• T1078.003 Local Accounts · simulation
• T1082 System Information Discovery · simulation
• T1087.001 Local Account · simulation
• T1090.001 Internal Proxy · simulation
• T1090.003 Multi-hop Proxy · simulation
• T1098 Account Manipulation · simulation
• T1105 Ingress Tool Transfer · simulation
• T1110.001 Password Guessing · simulation
• T1110.002 Password Cracking · simulation
• T1112 Modify Registry · simulation
• T1113 Screen Capture · simulation
• T1133 External Remote Services · simulation
• T1134.001 Token Impersonation/Theft · simulation
• T1134.002 Create Process with Token · simulation
• T1134.005 SID-History Injection · simulation
• T1135 Network Share Discovery · simulation
• T1136.001 Local Account · simulation
• T1137.001 Office Template Macros · simulation
• T1176 Software Extensions · simulation
• T1201 Password Policy Discovery · simulation
• T1207 Rogue Domain Controller · simulation
• T1217 Browser Information Discovery · simulation
• T1218 System Binary Proxy Execution · simulation
• T1218.009 Regsvcs/Regasm · simulation
• T1219 Remote Access Tools · simulation
• T1222 File and Directory Permissions Modification · simulation
• T1222.001 Windows Permissions · simulation
• T1222.002 Linux and Mac Permissions · simulation
• T1484.001 Group Policy Modification · simulation
• T1486 Data Encrypted for Impact · simulation
• T1489 Service Stop · simulation
• T1490 Inhibit System Recovery · simulation
• T1491.001 Internal Defacement · simulation
• T1497.001 System Checks · simulation
• T1505.002 Transport Agent · simulation
• T1505.005 Terminal Services DLL · simulation
• T1518.001 Security Software Discovery · simulation
• T1529 System Shutdown/Reboot · simulation
• T1531 Account Access Removal · simulation
• T1542.001 System Firmware · simulation
• T1543.001 Launch Agent · simulation
• T1543.002 Systemd Service · simulation
• T1543.003 Windows Service · simulation
• T1543.004 Launch Daemon · simulation
• T1546 Event Triggered Execution · simulation
• T1546.001 Change Default File Association · simulation
• T1546.002 Screensaver · simulation
• T1546.003 Windows Management Instrumentation Event Subscription · simulation
• T1546.004 Unix Shell Configuration Modification · simulation
• T1546.007 Netsh Helper DLL · simulation
• T1546.008 Accessibility Features · simulation
• T1546.009 AppCert DLLs · simulation
• T1546.010 AppInit DLLs · simulation
• T1546.011 Application Shimming · simulation
• T1546.012 Image File Execution Options Injection · simulation
• T1546.013 PowerShell Profile · simulation
• T1546.014 Emond · simulation
• T1547 Boot or Logon Autostart Execution · simulation
• T1547.001 Registry Run Keys / Startup Folder · simulation
• T1547.002 Authentication Package · simulation
• T1547.003 Time Providers · simulation
• T1547.005 Security Support Provider · simulation
• T1547.006 Kernel Modules and Extensions · simulation
• T1547.007 Re-opened Applications · simulation
• T1547.008 LSASS Driver · simulation
• T1547.009 Shortcut Modification · simulation
• T1547.010 Port Monitors · simulation
• T1547.012 Print Processors · simulation
• T1547.014 Active Setup · simulation
• T1548.001 Setuid and Setgid · simulation
• T1548.002 Bypass User Account Control · simulation
• T1548.003 Sudo and Sudo Caching · simulation
• T1550.003 Pass the Ticket · simulation
• T1552 Unsecured Credentials · simulation
• T1552.001 Credentials In Files · simulation
• T1552.004 Private Keys · simulation
• T1553.003 SIP and Trust Provider Hijacking · simulation
• T1553.004 Install Root Certificate · simulation
• T1553.005 Mark-of-the-Web Bypass · simulation
• T1553.006 Code Signing Policy Modification · simulation
• T1555.001 Keychain · simulation
• T1555.003 Credentials from Web Browsers · simulation
• T1555.006 Cloud Secrets Management Stores · simulation
• T1556.001 Domain Controller Authentication · simulation
• T1556.002 Password Filter DLL · simulation
• T1556.003 Pluggable Authentication Modules · simulation
• T1557.001 Name Resolution Poisoning and SMB Relay · simulation
• T1559 Inter-Process Communication · simulation
• T1560.001 Archive via Utility · simulation
• T1563.002 RDP Hijacking · simulation
• T1564 Hide Artifacts · simulation
• T1564.001 Hidden Files and Directories · simulation
• T1564.002 Hidden Users · simulation
• T1564.003 Hidden Window · simulation
• T1564.004 NTFS File Attributes · simulation
• T1564.006 Run Virtual Instance · simulation
• T1569.002 Service Execution · simulation
• T1569.003 Systemctl · simulation
• T1570 Lateral Tool Transfer · simulation
• T1572 Protocol Tunneling · simulation
• T1574.001 DLL · simulation
• T1574.006 Dynamic Linker Hijacking · simulation
• T1574.009 Path Interception by Unquoted Path · simulation
• T1574.012 COR_PROFILER · simulation
• T1611 Escape to Host · simulation
• T1614.001 System Language Discovery · simulation
• T1615 Group Policy Discovery · simulation
• T1622 Debugger Evasion · simulation
• T1654 Log Enumeration · simulation
• T1685 Disable or Modify Tools · simulation
• T1685.001 Disable or Modify Windows Event Log · simulation
• T1685.004 Disable or Modify Linux Audit System Log · simulation
• T1685.005 Clear Windows Event Logs · simulation
• T1685.006 Clear Linux or Mac System Logs · simulation
• T1686 Disable or Modify System Firewall · simulation
• T1686.003 Windows Host Firewall · simulation
• T1688 Safe Mode Boot · simulation
• T1689 Downgrade Attack · simulation
• T1690 Prevent Command History Logging · simulation