Abuse Elevation Control Mechanism `T1548`

Tactic: Privilege Escalation

Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.

Events covered

33 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 5	Process terminated
Sysmon	Event ID 7	Image loaded
Sysmon	Event ID 10	ProcessAccess
Sysmon	Event ID 11	FileCreate
Sysmon	Event ID 12	RegistryEvent (Object create and delete)
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 14	RegistryEvent (Key and Value Rename)
Security-Auditing	Event ID 4624	An account was successfully logged on.
Security-Auditing	Event ID 4657	A registry value was modified.
Security-Auditing	Event ID 4663	An attempt was made to access an object.
Security-Auditing	Event ID 4674	An operation was attempted on a privileged object.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4689	A process has exited.
Defender-CloudAppEvents	any	Cloud app activity
Defender-DeviceRegistryEvents	RegistryKeyDeleted	Registry key deleted
Defender-DeviceRegistryEvents	RegistryValueSet	Registry value set
Defender-DeviceRegistryEvents	RegistryValueDeleted	Registry value deleted
Defender-DeviceRegistryEvents	RegistryKeyRenamed	Registry key renamed
Defender-IdentityInfo	any	Identity information
ESF	exec	Process Execution
ESF	open	File Open
Linux-Auditd	Event ID 1300	SYSCALL
Linux-Auditd	Event ID 1302	PATH
Linux-Auditd	Event ID 1307	CWD
Linux-Auditd	Event ID 1309	EXECVE
Linux-Auditd	Event ID 1321	BPRM_FCAPS
Linux-Auditd	Event ID 1327	PROCTITLE
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
NETLOGON	Event ID 5829	The Netlogon service allowed a vulnerable Netlogon secure channel connection.
Sysmon-for-Linux	Event ID 1	Process Create
Sysmon-for-Linux	Event ID 11	File created

Authoring guide

These 366 rules share fields, values, and exclusions.

Fields filtered most (168 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	95	`eq` 78, `in` 19, `ne` 2	`exec`, `start`, `uid_change`, `rename`, `exec_event`
`process_basename`	73	`eq` 55, `in` 18, `starts_with` 6, `is_not_null` 3, `contains` 1, `ends_with` 1, `ne` 1	`dllhost.exe`, `bash`, `chmod`, `sudo`, `setcap`
`CommandLine`	67	`contains` 51, `eq` 11, `wildcard` 7, `in` 5, `ends_with` 3, `regex_match` 3, `starts_with` 2, `match` 1	`sudo`, `--eval`, `(?i)ms-settings\x5cshell\x5copen\x5ccommand.+`, `-e`, `-wrapper`
`event.type`	63	`eq` 54, `in` 7, `ne` 2	`start`, `change`, `process_started`, `creation`, `deletion`
`Image`	57	`ends_with` 28, `wildcard` 9, `is_not_null` 7, `contains` 5, `eq` 5, `starts_with` 4, `in` 2	, `/dev/shm/`, `/home//`, `.`, `\dism.exe`
`parent_process_basename`	44	`eq` 29, `in` 13, `wildcard` 7	`bash`, `.*`, `bun`, `csh`, `dash`
`process.args`	39	`eq` 23, `in` 14, `wildcard` 10, `starts_with` 5, `contains` 2, `regex_match` 1	`+x`, `--command`, `-2000`, `-4000`, `-6000`
`ParentImage`	34	`ends_with` 17, `wildcard` 10, `contains` 3, `eq` 2, `in` 2, `is_not_null` 1, `starts_with` 1	`/dev/shm/`, `/home//`, `./`, `.`, `\ProgramData\*`
`TargetFilename`	32	`starts_with` 14, `ends_with` 11, `wildcard` 11, `eq` 4, `in` 3, `contains` 2, `regex_match` 1	`C:\Users\`, `/etc/doas.conf`, `(?i)^C:\\Users\\[^\\]+\\NTUSER\.DAT$`, `/etc/doas.conf`, `sudoers.tmp*`
`EventID`	25	`eq` 25	`4688`, `1`, `4657`, `13`, `4103`
`TargetObject`	23	`contains` 9, `ends_with` 8, `wildcard` 6, `eq` 1	`Software\Classes\ms-settings\shell\open\command`, `\ms-settings`, `\ms-windows-store`, `Classes\exefile\shell\open\command\(Default)`, `Classes\ms-settings\shell\open\command\(Default)`
`process.Ext.token.integrity_level_name`	23	`eq` 23	`high`, `system`, `medium`
`IntegrityLevel`	22	`eq` 20, `in` 4	`High`, `S-1-16-12288`, `S-1-16-16384`, `high`, `low`
`Details`	20	`eq` 13, `contains` 3, `ends_with` 3, `is_not_null` 2, `regex_match` 1, `starts_with` 1	`0x00000000`, , `(Empty)`, `*.dll`, `0`
`user.id`	18	`ne` 13, `eq` 12, `is_not_null` 1, `starts_with` 1	`0`, , `S-1-0-0`, `S-1-12-*`, `S-1-5-18`

Top indicator values (2394 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.type`	`eq`	`start` elasticBypass UAC via Event Viewer elasticExecuteWithPrivileges Prompt via Unsigned or Untrusted Application elasticPod or Container Creation with Suspicious Command-Line elasticPotential CVE-2025-32463 Sudo Chroot Execution Attempt elasticPotential PackageKit TOCTOU Privilege Escalation via CVE-2026-41651 elasticPotential Privacy Control Bypass via Localhost Secure Copy elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via CVE-2023-4911 elasticPotential Privilege Escalation via Enlightenment elasticPotential Privilege Escalation via Python cap_setuid elasticPotential Privilege Escalation via Recently Compiled Executable +33 more rules	48	1036
`event.type`	`eq`	`change` elasticDisabling User Account Control via Registry Modification elasticLocal Account TokenFilter Policy Disabled elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via Enlightenment elasticPotential Privilege Escalation via Python cap_setuid elasticPotential Privilege Escalation via Recently Compiled Executable elasticPotential Privilege Escalation via unshare and UID Change elasticPotential Sudo Token Manipulation via Process Injection elasticPrivilege Escalation via CAP_CHOWN/CAP_FOWNER Capabilities elasticPrivilege Escalation via CAP_SETUID/SETGID Capabilities	12	89
`EventType`	`eq`	`exec` elasticElevated Apple Script Execution via Unsigned Parent elasticExecuteWithPrivileges Prompt via Unsigned or Untrusted Application elasticExecution via Electron Child Process Node.js Module elasticPotential PackageKit TOCTOU Privilege Escalation via CVE-2026-41651 elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via CVE-2023-4911 elasticPotential Privilege Escalation via Enlightenment elasticPotential Privilege Escalation via Python cap_setuid elasticPotential Privilege Escalation via Recently Compiled Executable elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID +20 more rules	35	547
`EventType`	`eq`	`start` elasticPotential UAC Bypass via IElevatedFactoryServer elasticUAC Bypass Attempt via CDSSync Scheduled Task Hijack elasticUAC Bypass Attempt via Consent DLL Search Order Hijacking elasticUAC Bypass Attempt via DCCW DLL Search Order Hijacking elasticUAC Bypass Attempt via DismCore DLL Side-Loading elasticUAC Bypass Attempt via DLL Side-Loading from Windows Media Player Folder elasticUAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer elasticUAC Bypass Attempt via MMC DLL Search Order Hijacking elasticUAC Bypass Attempt via SilentCleanup Task DLL Search Order Hijacking elasticUAC Bypass Attempt via Windows Directory Masquerading elasticUAC Bypass Attempt via WOW64 Logger DLL Side-Loading elasticUAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface elasticUAC Bypass via ComputerDefaults Execution Hijack elasticUAC Bypass via Control Panel Execution Hijack elasticUAC Bypass via DelegateExecute Registry Modification +10 more rules	25	388
`EventType`	`eq`	`uid_change` elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via Enlightenment elasticPotential Privilege Escalation via unshare and UID Change elasticPotential Sudo Token Manipulation via Process Injection elasticPrivilege Escalation via CAP_SETUID/SETGID Capabilities	7	17
`CommandLine`	`contains`	`sudo` splunkLinux APT Privilege Escalation splunkLinux AWK Privilege Escalation splunkLinux Busybox Privilege Escalation splunkLinux c89 Privilege Escalation splunkLinux c99 Privilege Escalation splunkLinux Composer Privilege Escalation splunkLinux Cpulimit Privilege Escalation splunkLinux Csvtool Privilege Escalation splunkLinux Emacs Privilege Escalation splunkLinux Find Privilege Escalation splunkLinux GDB Privilege Escalation splunkLinux Gem Privilege Escalation splunkLinux GNU Awk Privilege Escalation splunkLinux Make Privilege Escalation splunkLinux MySQL Privilege Escalation +7 more rules	22	24
`IntegrityLevel`	`eq`	`S-1-16-16384` sigmaAlways Install Elevated Windows Installer sigmaCMSTP UAC Bypass via COM Object Access sigmaUAC Bypass Abusing Winsat Path Parsing - Process sigmaUAC Bypass Tools Using ComputerDefaults sigmaUAC Bypass Using ChangePK and SLUI sigmaUAC Bypass Using Consent and Comctl32 - Process sigmaUAC Bypass Using Disk Cleanup sigmaUAC Bypass Using DismHost sigmaUAC Bypass Using IDiagnostic Profile sigmaUAC Bypass Using IEInstal - Process sigmaUAC Bypass Using MSConfig Token Modification - Process sigmaUAC Bypass Using NTFS Reparse Point - Process sigmaUAC Bypass Using PkgMgr and DISM sigmaUAC Bypass Using Windows Media Player - Process sigmaUAC Bypass WSReset +4 more rules	19	31
`IntegrityLevel`	`eq`	`High` sigmaCMSTP UAC Bypass via COM Object Access sigmaPotential UAC Bypass Via Sdclt.EXE sigmaUAC Bypass Abusing Winsat Path Parsing - Process sigmaUAC Bypass Tools Using ComputerDefaults sigmaUAC Bypass Using ChangePK and SLUI sigmaUAC Bypass Using Consent and Comctl32 - Process sigmaUAC Bypass Using Disk Cleanup sigmaUAC Bypass Using DismHost sigmaUAC Bypass Using IDiagnostic Profile sigmaUAC Bypass Using IEInstal - Process sigmaUAC Bypass Using MSConfig Token Modification - Process sigmaUAC Bypass Using NTFS Reparse Point - Process sigmaUAC Bypass Using PkgMgr and DISM sigmaUAC Bypass Using Windows Media Player - Process sigmaUAC Bypass WSReset +1 more rules	16	18
`process.Ext.token.integrity_level_name`	`eq`	`high` elasticUAC Bypass Attempt via CDSSync Scheduled Task Hijack elasticUAC Bypass Attempt via DCCW DLL Search Order Hijacking elasticUAC Bypass Attempt via DismCore DLL Side-Loading elasticUAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer elasticUAC Bypass Attempt via MMC DLL Search Order Hijacking elasticUAC Bypass Attempt via SilentCleanup Task DLL Search Order Hijacking elasticUAC Bypass Attempt via Windows Directory Masquerading elasticUAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface elasticUAC Bypass via ComputerDefaults Execution Hijack elasticUAC Bypass via Control Panel Execution Hijack elasticUAC Bypass via DiskCleanup Scheduled Task Hijack elasticUAC Bypass via Event Viewer elasticUAC Bypass via FodHelper Execution Hijack elasticUAC Bypass via ICMLuaUtil Elevated COM Interface elasticUAC Bypass via Malicious MMC Snap-In Execution +4 more rules	19	19
`event.outcome`	`eq`	`success` elasticAWS EC2 Instance Profile Associated with Running Instance elasticAWS IAM Customer Managed Policy Version Created or Default Version Set elasticAWS IAM Customer-Managed Policy Attached to Role by Rare User elasticAWS KMS Key Policy Updated via PutKeyPolicy elasticAWS STS AssumeRole with New MFA Device elasticAWS STS AssumeRoot by Rare User and Member Account elasticAWS STS GetFederationToken with AdministratorAccess in Request elasticAWS STS GetSessionToken Usage elasticAWS STS Role Assumption by Service elasticAWS STS Role Assumption by User elasticAWS STS Role Chaining	11	306
`user.id`	`ne`	`0` elasticPotential Copy Fail (CVE-2026-31431) Exploitation via AF_ALG Socket elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via Python cap_setuid elasticPotential Privilege Escalation via Recently Compiled Executable elasticPotential Privilege Escalation via unshare and UID Change elasticPrivilege Escalation via CAP_CHOWN/CAP_FOWNER Capabilities elasticPrivilege Escalation via CAP_SETUID/SETGID Capabilities elasticPrivilege Escalation via GDB CAP_SYS_PTRACE elasticSuspicious SUID Binary Execution (Auditd Sequence)	11	19
`protoPayload.authorizationInfo`	`is_not_null`	pantherGCP CloudBuild Potential Privilege Escalation pantherGCP cloudfunctions functions create pantherGCP cloudfunctions functions update pantherGCP IAM serviceAccounts getAccessToken Privilege Escalation pantherGCP IAM serviceAccounts signBlob pantherGCP IAM serviceAccounts.signJwt Privilege Escalation pantherGCP K8S Privileged Pod Created pantherGCP serviceusage.apiKeys.create Privilege Escalation pantherGCP.Iam.ServiceAccountKeys.Create pantherGCP.Privilege.Escalation.By.Deployments.Create	10	17
`process_basename`	`eq`	`dllhost.exe` elasticPotential Privilege Escalation via Elevated IFileOperation elasticPotential UAC Bypass via IElevatedFactoryServer elasticUAC Bypass Attempt via Consent DLL Search Order Hijacking elasticUAC Bypass Attempt via DCCW DLL Search Order Hijacking elasticUAC Bypass Attempt via DismCore DLL Side-Loading elasticUAC Bypass Attempt via DLL Side-Loading from Windows Media Player Folder elasticUAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer elasticUAC Bypass Attempt via Privileged IFileOperation COM Interface elasticUAC Bypass via Windows Firewall Snap-In Hijack	9	19
`user.id`	`eq`	`0` elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via Enlightenment elasticPotential Privilege Escalation via Python cap_setuid elasticPotential Privilege Escalation via Recently Compiled Executable elasticPotential Privilege Escalation via unshare and UID Change elasticPrivilege Escalation via CAP_SETUID/SETGID Capabilities elasticPrivilege Escalation via GDB CAP_SYS_PTRACE	9	14
`EventID`	`eq`	`1` splunkComputerDefaults UAC Bypass (Sysmon) splunkConsentPromptBehaviorAdmin Registry Value Modified (Sysmon) splunkEnableLUA Registry Value Modified (Sysmon) splunkMock System Directory - Windows (Sysmon) splunkPotential fodhelper UAC Bypass Attempt (Sysmon) splunkPromptOnSecureDesktop Registry Value Modified (Sysmon) splunkSuspicious ComputerDefaults.exe Execution (Sysmon) splunkWindows Privilege Escalation System Process Without System Parent	8	226
`EventID`	`eq`	`4688` splunkComputerDefaults UAC Bypass (Windows Event Log) splunkConsentPromptBehaviorAdmin Registry Value Modified (Windows Event Log) splunkEnableLUA Registry Value Modified (Windows Event Log) splunkIndirect Command Execution (Windows Event Log) splunkMock System Directory - Windows (Windows Event Log) splunkPotential fodhelper UAC Bypass Attempt (Windows Event Log) splunkPromptOnSecureDesktop Registry Value Modified (Windows Event Log) splunkSuspicious ComputerDefaults.exe Execution (Windows Event Log)	8	284
`parent_process_basename`	`in`	`bash` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSudo Command Enumeration Detected elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution elasticSuspicious Symbolic Link Created	8	60
`parent_process_basename`	`in`	`csh` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSudo Command Enumeration Detected elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution elasticSuspicious Symbolic Link Created	8	37
`parent_process_basename`	`in`	`dash` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSudo Command Enumeration Detected elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution elasticSuspicious Symbolic Link Created	8	38
`parent_process_basename`	`in`	`fish` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSudo Command Enumeration Detected elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution elasticSuspicious Symbolic Link Created	8	38
`parent_process_basename`	`in`	`ksh` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSudo Command Enumeration Detected elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution elasticSuspicious Symbolic Link Created	8	38
`parent_process_basename`	`in`	`sh` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSudo Command Enumeration Detected elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution elasticSuspicious Symbolic Link Created	8	60
`parent_process_basename`	`in`	`tcsh` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSudo Command Enumeration Detected elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution elasticSuspicious Symbolic Link Created	8	38
`parent_process_basename`	`in`	`zsh` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSudo Command Enumeration Detected elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution elasticSuspicious Symbolic Link Created	8	60
`process_basename`	`in`	`bash` elasticElevated Apple Script Execution via Unsigned Parent elasticFile Execution Permission Modification Detected via Defend for Containers elasticFull Disk Access Permission Check elasticPotential Copy Fail (CVE-2026-31431) Exploitation via AF_ALG Socket elasticPotential Privilege Escalation via SUID Binary elasticPrivilege Escalation via SUID/SGID elasticSuspicious Echo or Printf Execution Detected via Defend for Containers elasticSuspicious SUID Binary Execution (Auditd Sequence)	8	181
`process_basename`	`in`	`dash` elasticElevated Apple Script Execution via Unsigned Parent elasticFile Execution Permission Modification Detected via Defend for Containers elasticPotential Copy Fail (CVE-2026-31431) Exploitation via AF_ALG Socket elasticPotential Privilege Escalation via SUID Binary elasticPrivilege Escalation via SUID/SGID elasticSuspicious Echo or Printf Execution Detected via Defend for Containers elasticSuspicious SUID Binary Execution (Auditd Sequence)	7	150
`process_basename`	`in`	`fish` elasticElevated Apple Script Execution via Unsigned Parent elasticFile Execution Permission Modification Detected via Defend for Containers elasticPotential Copy Fail (CVE-2026-31431) Exploitation via AF_ALG Socket elasticPotential Privilege Escalation via SUID Binary elasticPrivilege Escalation via SUID/SGID elasticSuspicious Echo or Printf Execution Detected via Defend for Containers elasticSuspicious SUID Binary Execution (Auditd Sequence)	7	151
`sourcetype`	`eq`	`auditd` splunkLinux Auditd Doas Conf File Creation splunkLinux Auditd Doas Tool Execution splunkLinux Auditd Nopasswd Entry In Sudoers File splunkLinux Auditd Possible Access To Sudoers File splunkLinux Auditd Setuid Using Chmod Utility splunkLinux Auditd Setuid Using Setcap Utility splunkLinux Auditd Sudo Or Su Execution splunkLinux Dirty Frag Kernel Privilege Escalation	8	58
`Image`	`is_not_null`	elasticPotential Privilege Escalation via TCC bypass with fake TCC.db elasticPotential Root Effective Shell from Non-Standard Path via Auditd elasticShell Privileged Mode from Non-Standard Path with Root Effective User elasticUAC Bypass via DelegateExecute Registry Modification elasticUAC Bypass via DiskCleanup Scheduled Task Hijack elasticUAC Bypass via Unsafe Deserialization in Event Viewer elasticUser TCC DB Access by Osascript	7	155
`Provider_Name`	`eq`	`sts.amazonaws.com` elasticAWS STS AssumeRole with New MFA Device elasticAWS STS AssumeRoot by Rare User and Member Account elasticAWS STS GetFederationToken with AdministratorAccess in Request elasticAWS STS GetSessionToken Usage elasticAWS STS Role Assumption by Service elasticAWS STS Role Assumption by User elasticAWS STS Role Chaining	7	11

Exclusions (733 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`Image`	`eq`	`?:\Windows\SysWOW64\WerFault.exe` elasticUAC Bypass Attempt via Consent DLL Search Order Hijacking elasticUAC Bypass Attempt via DCCW DLL Search Order Hijacking elasticUAC Bypass Attempt via DismCore DLL Side-Loading elasticUAC Bypass Attempt via MMC DLL Search Order Hijacking elasticUAC Bypass Attempt via WOW64 Logger DLL Side-Loading elasticUAC Bypass via ComputerDefaults Execution Hijack elasticUAC Bypass via FodHelper Execution Hijack elasticUAC Bypass via ICMLuaUtil Elevated COM Interface elasticUAC Bypass via Malicious MMC Snap-In Execution elasticUAC Bypass via Sdclt elasticUAC Bypass via Windows Activation Execution Hijack elasticUAC Bypass via Windows Firewall Snap-In Hijack elasticUAC Bypass via WSReset Execution Hijack	13
`Image`	`eq`	`?:\Windows\System32\WerFault.exe` elasticUAC Bypass Attempt via Consent DLL Search Order Hijacking elasticUAC Bypass Attempt via DCCW DLL Search Order Hijacking elasticUAC Bypass Attempt via DismCore DLL Side-Loading elasticUAC Bypass Attempt via MMC DLL Search Order Hijacking elasticUAC Bypass Attempt via WOW64 Logger DLL Side-Loading elasticUAC Bypass via ComputerDefaults Execution Hijack elasticUAC Bypass via FodHelper Execution Hijack elasticUAC Bypass via ICMLuaUtil Elevated COM Interface elasticUAC Bypass via Malicious MMC Snap-In Execution elasticUAC Bypass via Sdclt elasticUAC Bypass via Windows Activation Execution Hijack elasticUAC Bypass via Windows Firewall Snap-In Hijack elasticUAC Bypass via WSReset Execution Hijack	13
`Image`	`eq`	`?:\Windows\SysWOW64\wermgr.exe` elasticUAC Bypass Attempt via Consent DLL Search Order Hijacking elasticUAC Bypass Attempt via DismCore DLL Side-Loading elasticUAC Bypass Attempt via WOW64 Logger DLL Side-Loading elasticUAC Bypass via ICMLuaUtil Elevated COM Interface elasticUAC Bypass via Sdclt elasticUAC Bypass via Windows Firewall Snap-In Hijack	6
`Image`	`eq`	`?:\Windows\System32\wermgr.exe` elasticUAC Bypass Attempt via Consent DLL Search Order Hijacking elasticUAC Bypass Attempt via DismCore DLL Side-Loading elasticUAC Bypass Attempt via WOW64 Logger DLL Side-Loading elasticUAC Bypass via ICMLuaUtil Elevated COM Interface elasticUAC Bypass via Sdclt elasticUAC Bypass via Windows Firewall Snap-In Hijack	6
`Image`	`eq`	`?:\Windows\System32\conhost.exe` elasticUAC Bypass Attempt via DismCore DLL Side-Loading elasticUAC Bypass Attempt via WOW64 Logger DLL Side-Loading elasticUAC Bypass via WSReset Execution Hijack	3
`process.code_signature.trusted`	`eq`	`true` elasticUAC Bypass Attempt via CDSSync Scheduled Task Hijack elasticUAC Bypass Attempt via DismCore DLL Side-Loading elasticUAC Bypass Attempt via SilentCleanup Task DLL Search Order Hijacking elasticUAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface elasticUAC Bypass via DelegateExecute Registry Modification elasticUAC Bypass via ICMLuaUtil Elevated COM Interface elasticUAC Bypass via Unsafe Deserialization in Event Viewer	7
`Image`	`in`	`/usr/bin/sudo` elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change elasticPrivilege Escalation via CAP_SETUID/SETGID Capabilities	4
`Image`	`in`	`/bin/sudo` elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change	3
`Image`	`wildcard`	`?:\Program Files (x86)\*.exe` elasticUAC Bypass via DelegateExecute Registry Modification elasticUAC Bypass via Event Viewer elasticUAC Bypass via Unsafe Deserialization in Event Viewer	3
`Image`	`wildcard`	`?:\Program Files\*.exe` elasticUAC Bypass via DelegateExecute Registry Modification elasticUAC Bypass via Event Viewer elasticUAC Bypass via Unsafe Deserialization in Event Viewer	3
`Image`	`wildcard`	`?:\Windows\SysWOW64\mmc.exe` elasticBypass UAC via Event Viewer elasticUAC Bypass via Event Viewer elasticUAC Bypass via Unsafe Deserialization in Event Viewer	3
`Image`	`wildcard`	`?:\Windows\System32\mmc.exe` elasticBypass UAC via Event Viewer elasticUAC Bypass via Event Viewer elasticUAC Bypass via Unsafe Deserialization in Event Viewer	3
`ParentImage`	`wildcard`	`/tmp/newroot/*` elasticProcess Capability Set via setcap Utility elasticSUID/SGID Bit Set elasticSystem Binary Path File Permission Modification	3
`aws::errorCode`	`is_not_null`	pantherAWS STS GetSessionToken by IAM User pantherIAM Assume Role Blocklist Ignored pantherIAM Policy Modified	3
`aws::errorMessage`	`is_not_null`	pantherAWS STS GetSessionToken by IAM User pantherIAM Assume Role Blocklist Ignored pantherIAM Policy Modified	3

Abuse Elevation Control Mechanism `T1548`

Events covered

Authoring guide

Fields filtered most (168 distinct)

Top indicator values (2394 distinct)

Exclusions (733 distinct)

Rules under this technique

Sigma 90 rules

Elastic 120 rules

Splunk 90 rules

Kusto 46 rules

Panther 20 rules

Abuse Elevation Control Mechanism T1548

Events covered

Authoring guide

Fields filtered most (168 distinct)

Top indicator values (2394 distinct)

Exclusions (733 distinct)

Rules under this technique

Sigma 90 rules

Elastic 120 rules

Splunk 90 rules

Kusto 46 rules

Panther 20 rules

Abuse Elevation Control Mechanism `T1548`