1200KM / simulation
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control…
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.[TechNet How UAC Works][sudo man page 2018] An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.[OSX Keydnap malware][Fortinet Fareit]
Official technique definition · Open in the interactive matrix
Related pages are navigation context. Their tools, rules and lab results are not automatically inherited.
These contracts are selected through exact technique-to-data-component relationships or explicitly labelled planning overrides. Configure a collector at the relevant observation point; a telemetry name alone is not coverage.
DC0059 collection page — Collect scoped file inventory/FIM metadata with hash algorithm and observation time; preserve original timestamps separately from collector time.
Required normalized fields: path, size_bytes, sha256, owner_uid.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0059",
"collector": "illustrative-lab-collector",
"observation": {
"path": "/opt/lab/demo.txt",
"size_bytes": 64,
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"owner_uid": 1000
}
}Visibility limits: Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.
DC0088 collection page — Collect supported session inventory and correlate session IDs with authentication, logon and logoff events.
Required normalized fields: session_id, account, host, session_type.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0088",
"collector": "illustrative-lab-collector",
"observation": {
"session_id": "lab-session-1",
"account": "LAB\\analyst",
"host": "lab-host-1",
"session_type": "interactive"
}
}Visibility limits: Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.
DC0021 collection page — Use an approved EDR trace or instrument the owned lab process at selected APIs. Define API name, caller, sanitized arguments and return status.
Required normalized fields: process_id, api, path, result.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0021",
"collector": "illustrative-lab-collector",
"observation": {
"process_id": 4200,
"api": "CreateFileW",
"path": "C:\\Lab\\demo.txt",
"result": "success"
}
}Visibility limits: Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.
DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.
Required normalized fields: process_guid, image, parent_image, command_line, user.
<EventFiltering>
<ProcessCreate onmatch="include">
<Image condition="is">C:\Windows\System32\whoami.exe</Image>
</ProcessCreate>
</EventFiltering>This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0032",
"collector": "illustrative-lab-collector",
"observation": {
"process_guid": "lab-process-001",
"image": "C:\\Windows\\System32\\whoami.exe",
"parent_image": "C:\\Windows\\System32\\cmd.exe",
"command_line": "whoami",
"user": "LAB\\analyst"
}
}Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
DC0034 collection page — Collect read-only process inventory with PID plus start time/stable identity, command line and collection time; restrict access to potentially sensitive arguments.
Required normalized fields: process_id, image, owner_uid, started_at.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0034",
"collector": "illustrative-lab-collector",
"observation": {
"process_id": 4200,
"image": "/usr/bin/sleep",
"owner_uid": 1000,
"started_at": "2026-09-27T11:59:00Z"
}
}Visibility limits: Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.
DC0010 collection page — Enable Audit User Account Management and retain the changed attributes and target account; correlate approved administrative requests.
Required normalized fields: target_account, attribute, before, after.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0010",
"collector": "illustrative-lab-collector",
"observation": {
"target_account": "lab-temp",
"attribute": "enabled",
"before": false,
"after": true
}
}Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.
DC0063 collection page — Use RegistryEvent 13 for value-set and 14 for rename; compare against intended policy and keep original type/value where available.
Required normalized fields: registry_path, event_type, value_type, value.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0063",
"collector": "illustrative-lab-collector",
"observation": {
"registry_path": "HKCU\\Software\\Lab\\Mode",
"event_type": "SetValue",
"value_type": "DWORD",
"value": 1
}
}Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
Open the dedicated detection workspace · Existing query engineering
Correlate registry modifications (e.g., UAC bypass registry keys), unusual parent-child process relationships (e.g., control.exe spawning cmd.exe), and unsigned elevated process executions with non-standard tokens or elevation flags.
Platforms: Windows.
Monitor audit logs for setuid/setgid bit changes, executions where UID ≠ EUID (indicative of sudo or privilege escalation), and high-integrity binaries launched by unprivileged users.
Platforms: Linux.
Detect execution of `/usr/libexec/security_authtrampoline` or use of AuthorizationExecuteWithPrivileges API, and monitor process lineage for unusual launches of GUI apps with escalated privileges.
Platforms: macOS.
Monitor for unexpected privilege elevation operations via SAML assertion manipulation, role injection, or changes to identity mappings that result in access escalation.
Platforms: Identity Provider.
Detect sudden privilege escalations such as IAM role changes, user-assigned privilege boundaries, or elevation via assumed roles beyond normal behavior.
Platforms: IaaS.
22 exact-tagged source rules. A source tag is a discovery aid, not a relevance verdict. Check the observation point and actual condition of each rule.
MATCH(privilege_elevation) AND user_or_binary NOT_IN approved_elevation_list -> ALERTStart from the exact analytic above. The collection-specific lenses below are analyst recommendations; they do not assert that an arbitrary statistical deviation detects this technique.
Anomaly Detection Atlas · Baseline, validation and blind spots
No reviewed lab-tool association is selected for this exact technique. This is a curation gap, not a statement that no tool can implement the behavior.
These are exact ATT&CK software-use relationships, including malware. They provide behavior context, not recommendations to download or execute malware. No safety or detector claim is inherited.
Raspberry Robin implements a variation of the <code>ucmDccwCOMMethod</code> technique abusing the Windows AutoElevate backdoor to bypass UAC while elevating privileges.[TrendMicro RaspberryRobin 2022]
Exact relationship: relationship--9f30368d-3656-4ba1-8e53-94d5721f9241Atomic evidence: no compatible candidate in this snapshot. Live lab status: not run for these imported procedures.
Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.
No compatible Atomic procedure is present in this pinned evidence set. Technical feasibility has not been ruled out. A custom procedure must define the behavior, target, collection point, success observable and rollback before execution.
Download synthetic collection fixture (JSON) · Download the complete engineering workbook
This fixture exercises the listed collection fields. It does not reproduce Abuse Elevation Control Mechanism, label its example events as malicious, or measure detection effectiveness. Use the exact analytic and selected procedure to build an independently labelled behavior-positive dataset.
Not run in this browser. No network scan or attack command is executed by this control.
All-page audit and evidence inventory · This page’s machine-readable workbook
Pinned MITRE STIX source · SHA-256 81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352. Definition and procedure context are reproduced from this snapshot, not independently re-investigated incidents.
Limit the privileges of cloud accounts to assume, create, or impersonate additional roles, policies, and permissions to only those required. Where just-in-time access is enabled, consider requiring manual approval for temporary elevation of privileges.
The sudoers file should be strictly edited such that passwords are always required and that users can't spawn risky processes as users with higher privilege.
Remove users from the local administrator group on systems.
By requiring a password, even if an adversary can get terminal access, they must know the password to run anything in the sudoers file. Setting the timestamp_timeout to 0 will require the user to input their password every time sudo is executed.
Applications with known vulnerabilities or known shell escapes should not have the setuid or setgid bits set to reduce potential damage if an application is compromised. Additionally, the number of programs with setuid or setgid bits set should be minimized across a system. Ensuring that the sudo tty_tickets setting is enabled will prevent this leakage across tty sessions.
System settings can prevent applications from running that haven't been downloaded from legitimate repositories which may help mitigate some of these issues. Not allowing unsigned applications from being run may also mitigate some risk.
Check for common UAC bypass weaknesses on Windows systems to be aware of the risk posture and address issues where appropriate.[Github UACMe]
Perform regular software updates to mitigate exploitation risk.
Although UAC bypass techniques exist, it is still prudent to use the highest enforcement level for UAC when possible and mitigate bypass opportunities that exist with techniques such as DLL.
No reviewed association in this snapshot.
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Curated research views reached through an exact source technique, a catalog model, or a reviewed collection reference. These are navigation associations, not claims of detector effectiveness or sensor equivalence.
Telemetry contracts · Maintained query examples · Validation and blind spots
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.