Abuse Elevation Control Mechanism T1548
Tactic: Privilege Escalation
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Events covered
24 catalog events are tagged with this technique by at least one rule.
Authoring guide
Patterns shared across the 312 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.
Fields filtered most (177 distinct)
The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.
Top indicator values (2123 distinct)
Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.
Exclusions (422 distinct)
Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.
Rules under this technique
Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.
Sigma 89 rules
- Abused Debug Privilege by Arbitrary Parent Processes
- Always Install Elevated MSI Spawned Cmd And Powershell
- Always Install Elevated Windows Installer
- AWS STS AssumeRole Misuse
- AWS STS GetSessionToken Misuse
- AWS Suspicious SAML Activity
- Bypass UAC Using DelegateExecute
- Bypass UAC Using SilentCleanup Task
- Bypass UAC via CMSTP
- Bypass UAC via Fodhelper.exe
- Bypass UAC via WSReset.exe
- CA Policy Removed by Non Approved Actor
- CA Policy Updated by Non Approved Actor
- CMSTP UAC Bypass via COM Object Access
- COM Hijack via Sdclt
- Credential Dumping Attempt Via Svchost
- Explorer NOUACCHECK Flag
- Function Call From Undocumented COM Interface EditionUpgradeManager
- GCP Break-glass Container Workload Deployed
- HackTool - Empire PowerShell UAC Bypass
- HackTool - UACMe Akagi Execution
- HackTool - WinPwn Execution
- HackTool - WinPwn Execution - ScriptBlock
- High risk event - grant Management APIs scopes
- Linux Capabilities Discovery
- Linux Doas Conf File Creation
- Linux Doas Tool Execution
- Linux Setgid Capability Set on a Binary via Setcap Utility
- Linux Setuid Capability Set on a Binary via Setcap Utility
- macOS Multiple Failed Sudo Attempts
- macOS Setuid/Setgid Privilege Escalation
- macOS Sudo Privilege Escalation Attempts
- macOS TCC Privacy Bypass Attempt
- New CA Policy by Non-approved Actor
- Persistence Via Sudoers.d Files
- Potential Exploitation of CVE-2025-5054 or CVE-2025-4598
- Potential Privilege Escalation via Local Kerberos Relay over LDAP
- Potential UAC Bypass Via Sdclt.EXE
- Potentially Suspicious Event Viewer Child Process
- PowerShell Web Access Feature Enabled Via DISM
- PwnKit Local Privilege Escalation
- Regedit as Trusted Installer
- Registry Modification of MS-settings Protocol Handler
- SCM Database Privileged Operation
- Sdclt Child Processes
- Setuid and Setgid
- Shell Open Registry Keys Manipulation
- Sudo Privilege Escalation CVE-2019-14287
- Sudo Privilege Escalation CVE-2019-14287 - Builtin
- Suspicious Shell Open Command Registry Modification
- Trusted Path Bypass via Windows Directory Spoofing
- TrustedPath UAC Bypass Pattern
- UAC Bypass Abusing Winsat Path Parsing - File
- UAC Bypass Abusing Winsat Path Parsing - Process
- UAC Bypass Abusing Winsat Path Parsing - Registry
- UAC Bypass Tools Using ComputerDefaults
- UAC Bypass Using .NET Code Profiler on MMC
- UAC Bypass Using ChangePK and SLUI
- UAC Bypass Using Consent and Comctl32 - File
- UAC Bypass Using Consent and Comctl32 - Process
- UAC Bypass Using Disk Cleanup
- UAC Bypass Using DismHost
- UAC Bypass Using IDiagnostic Profile
- UAC Bypass Using IDiagnostic Profile - File
- UAC Bypass Using IEInstal - File
- UAC Bypass Using IEInstal - Process
- UAC Bypass Using Iscsicpl - ImageLoad
- UAC Bypass Using MSConfig Token Modification - File
- UAC Bypass Using MSConfig Token Modification - Process
- UAC Bypass Using NTFS Reparse Point - File
- UAC Bypass Using NTFS Reparse Point - Process
- UAC Bypass Using PkgMgr and DISM
- UAC Bypass Using Windows Media Player - File
- UAC Bypass Using Windows Media Player - Process
- UAC Bypass Using Windows Media Player - Registry
- UAC Bypass Using WOW64 Logger DLL Hijack
- UAC Bypass via Event Viewer
- UAC Bypass via ICMLuaUtil
- UAC Bypass via Sdclt
- UAC Bypass via Windows Firewall Snap-In Hijack
- UAC Bypass Via Wsreset
- UAC Bypass With Fake DLL
- UAC Bypass WSReset
- UAC Disabled
- UAC Notification Disabled
- UAC Secure Desktop Prompt Disabled
- User Added To Group With CA Policy Modification Access
- User Removed From Group With CA Policy Modification Access
- Vulnerable Netlogon Secure Channel Connection Allowed
Elastic 72 rules
- Apple Scripting Execution with Administrator Privileges
- AWS EC2 Instance Profile Associated with Running Instance
- AWS IAM Customer Managed Policy Version Created or Default Version Set
- AWS IAM Customer-Managed Policy Attached to Role by Rare User
- AWS KMS Key Policy Updated via PutKeyPolicy
- AWS STS AssumeRole with New MFA Device
- AWS STS AssumeRoot by Rare User and Member Account
- AWS STS GetFederationToken with AdministratorAccess in Request
- AWS STS GetSessionToken Usage
- AWS STS Role Assumption by Service
- AWS STS Role Assumption by User
- AWS STS Role Chaining
- Bypass UAC via Event Viewer
- Deprecated - Sudo Heap-Based Buffer Overflow Attempt
- Disabling User Account Control via Registry Modification
- Entra ID Actor Token User Impersonation Abuse
- Execution via Electron Child Process Node.js Module
- Execution with Explicit Credentials via Scripting
- File Execution Permission Modification Detected via Defend for Containers
- Full Disk Access Permission Check
- Local Account TokenFilter Policy Disabled
- Modification of Persistence Relevant Files Detected via Defend for Containers
- Pod or Container Creation with Suspicious Command-Line
- Potential Copy Fail (CVE-2026-31431) Exploitation via AF_ALG Socket
- Potential CVE-2025-32463 Sudo Chroot Execution Attempt
- Potential Defense Evasion via Doas
- Potential Persistence via File Modification
- Potential PowerShell HackTool Script by Function Names
- Potential Privacy Control Bypass via Localhost Secure Copy
- Potential Privacy Control Bypass via TCCDB Modification
- Potential Privilege Escalation via CVE-2023-4911
- Potential Privilege Escalation via Enlightenment
- Potential Privilege Escalation via Python cap_setuid
- Potential Privilege Escalation via Recently Compiled Executable
- Potential Privilege Escalation via Sudoers File Modification
- Potential Privilege Escalation via SUID/SGID
- Potential Privilege Escalation via SUID/SGID Proxy Execution
- Potential Privilege Escalation via unshare and UID Change
- Potential Root Effective Shell from Non-Standard Path via Auditd
- Potential Sudo Hijacking
- Potential Sudo Privilege Escalation via CVE-2019-14287
- Potential Sudo Token Manipulation via Process Injection
- Potential Suspicious File Edit
- Privilege Escalation via CAP_CHOWN/CAP_FOWNER Capabilities
- Privilege Escalation via CAP_SETUID/SETGID Capabilities
- Privilege Escalation via GDB CAP_SYS_PTRACE
- Privilege Escalation via SUID/SGID
- Process Capability Set via setcap Utility
- Setcap setuid/setgid Capability Set
- Spike in Privileged Command Execution by a User
- Sudo Command Enumeration Detected
- Sudoers File Activity
- SUID/SGID Bit Set
- SUID/SGUID Enumeration Detected
- Suspicious Echo or Printf Execution Detected via Defend for Containers
- Suspicious File Made Executable via Chmod Inside A Container
- Suspicious SUID Binary Execution
- Suspicious SUID Binary Execution (Auditd Sequence)
- Suspicious Symbolic Link Created
- Suspicious TCC Access Granted for User Folders
- System Binary Path File Permission Modification
- UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer
- UAC Bypass Attempt via Privileged IFileOperation COM Interface
- UAC Bypass Attempt via Windows Directory Masquerading
- UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface
- UAC Bypass via DiskCleanup Scheduled Task Hijack
- UAC Bypass via ICMLuaUtil Elevated COM Interface
- UAC Bypass via Windows Firewall Snap-In Hijack
- UID Elevation from Previously Unknown Executable
- Unusual Pkexec Execution
- Unusual Process Detected for Privileged Commands by a User
- Unusual Sudo Activity
Splunk 85 rules
- Allow Operation with Consent Admin
- ComputerDefaults UAC Bypass (PowerShell)
- ComputerDefaults UAC Bypass (Sysmon)
- ComputerDefaults UAC Bypass (Windows Event Log)
- ConsentPromptBehaviorAdmin Registry Value Modified (PowerShell)
- ConsentPromptBehaviorAdmin Registry Value Modified (Sysmon)
- ConsentPromptBehaviorAdmin Registry Value Modified (Windows Event Log)
- Disable UAC Remote Restriction
- Disabling Remote User Account Control
- EnableLUA Registry Value Modified (PowerShell)
- EnableLUA Registry Value Modified (Sysmon)
- EnableLUA Registry Value Modified (Windows Event Log)
- Eventvwr UAC Bypass
- FodHelper UAC Bypass
- Indirect Command Execution (Sysmon)
- Indirect Command Execution (Windows Event Log)
- Linux APT Privilege Escalation
- Linux Auditd Doas Conf File Creation
- Linux Auditd Doas Tool Execution
- Linux Auditd Nopasswd Entry In Sudoers File
- Linux Auditd Possible Access To Sudoers File
- Linux Auditd Setuid Using Chmod Utility
- Linux Auditd Setuid Using Setcap Utility
- Linux Auditd Sudo Or Su Execution
- Linux AWK Privilege Escalation
- Linux Busybox Privilege Escalation
- Linux c89 Privilege Escalation
- Linux c99 Privilege Escalation
- Linux Common Process For Elevation Control
- Linux Composer Privilege Escalation
- Linux Cpulimit Privilege Escalation
- Linux Csvtool Privilege Escalation
- Linux Doas Conf File Creation
- Linux Doas Tool Execution
- Linux Emacs Privilege Escalation
- Linux Find Privilege Escalation
- Linux GDB Privilege Escalation
- Linux Gem Privilege Escalation
- Linux GNU Awk Privilege Escalation
- Linux Make Privilege Escalation
- Linux MySQL Privilege Escalation
- Linux Node Privilege Escalation
- Linux NOPASSWD Entry In Sudoers File
- Linux Octave Privilege Escalation
- Linux OpenVPN Privilege Escalation
- Linux Persistence and Privilege Escalation Risk Behavior
- Linux PHP Privilege Escalation
- Linux Possible Access To Sudoers File
- Linux Puppet Privilege Escalation
- Linux RPM Privilege Escalation
- Linux Ruby Privilege Escalation
- Linux Setuid Using Chmod Utility
- Linux Setuid Using Setcap Utility
- Linux Sqlite3 Privilege Escalation
- Linux Sudo OR Su Execution
- Linux Sudoers Tmp File Creation
- Linux Telnet Authentication Bypass
- Linux Visudo Utility Execution
- Mock System Directory - Windows (Sysmon)
- Mock System Directory - Windows (Windows Event Log)
- NET Profiler UAC bypass
- Potential fodhelper UAC Bypass Attempt (PowerShell)
- Potential fodhelper UAC Bypass Attempt (Sysmon)
- Potential fodhelper UAC Bypass Attempt (Windows Event Log)
- PromptOnSecureDesktop Registry Value Modified (PowerShell)
- PromptOnSecureDesktop Registry Value Modified (Sysmon)
- PromptOnSecureDesktop Registry Value Modified (Windows Event Log)
- Sdclt UAC Bypass
- Services Escalate Exe
- SilentCleanup UAC Bypass
- SLUI RunAs Elevated
- SLUI Spawning a Process
- Suspicious ComputerDefaults.exe Execution (Sysmon)
- Suspicious ComputerDefaults.exe Execution (Windows Event Log)
- UAC Bypass MMC Load Unsigned Dll
- Windows Bypass UAC via Pkgmgr Tool
- Windows ComputerDefaults Spawning a Process
- Windows DISM Install PowerShell Web Access
- Windows Mock Trusted Directory MSC File Creation
- Windows Privilege Escalation Suspicious Process Elevation
- Windows Privilege Escalation System Process Without System Parent
- Windows Privilege Escalation User Process Spawn System Process
- Windows UAC Bypass Suspicious Child Process
- Windows UAC Bypass Suspicious Escalation Behavior
- WSReset UAC Bypass
Kusto 46 rules
- AFD WAF - Code Injection
- AFD WAF - Path Traversal Attack
- App Gateway WAF - Scanner Detection
- App GW WAF - Code Injection
- App GW WAF - Path Traversal Attack
- BTP - Cloud Integration access policy tampering
- CiscoISE - Command executed with the highest privileges from new IP
- CiscoISE - Command executed with the highest privileges by new user
- Critical Risks
- Cross-Cloud Suspicious Compute resource creation in GCP
- Cross-Cloud Suspicious user activity observed in GCP Envourment
- Dataverse - Bulk record ownership re-assignment or sharing
- Dataverse - Hierarchy security manipulation
- Dataverse - Suspicious security role modifications
- Detect PIM elevation with user risk
- Detecting Impossible travel with mailbox permission tampering & Privilege Escalation attempt
- Dynatrace - Problem detection
- Dynatrace Application Security - Code-Level runtime vulnerability detection
- Dynatrace Application Security - Non-critical runtime vulnerability detection
- Dynatrace Application Security - Third-Party runtime vulnerability detection
- Illusive Incidents Analytic Rule
- Pathlock TDnR - Authorization Check Value Changes (SU24)
- Pathlock TDnR - Authorization Profile Changes
- Pathlock TDnR - Authorization Role Changes
- Pathlock TDnR - Database Cockpit Audit Events
- Pathlock TDnR - Dynamic Access Control Events
- Pathlock TDnR - Emergency User (AdminTrack) Activity
- Pathlock TDnR - GRC Access Control Change Documents
- Pathlock TDnR - SAP Authorization Changes
- Pathlock TDnR - SU24 Table USOBT_C Changes
- Pathlock TDnR - SU24 Table USOBX_C Changes
- Pathlock TDnR - Switchable Authorization Design Changes
- Pathlock TDnR - Switchable Authorization Runtime Changes
- Pathlock TDnR - User Authorization Buffer Manipulation
- Pathlock TDnR - User Master Data Changes
- Pathlock TDnR - User-Profile Assignment Changes
- Pathlock TDnR - User-Role Assignment Changes
- Potential Fodhelper UAC Bypass
- Potential Fodhelper UAC Bypass (ASIM Version)
- Power Platform - Account added to privileged Microsoft Entra roles
- Powershell Empire Cmdlets Executed in Command Line
- Semperis DSP RBAC Changes
- Silverfort - NoPacBreach Incident
- Suspicious granting of permissions to an account
- Threats detected by Eset
- Vulerabilities
Panther 20 rules
- AppOmni Alert Passthrough
- AWS STS GetSessionToken by IAM User
- Box Large Number of Permission Changes
- GCP Cloud Run Service Created FOLLOWED BY Set IAM Policy
- GCP CloudBuild Potential Privilege Escalation
- GCP cloudfunctions functions create
- GCP cloudfunctions functions update
- GCP compute.instances.create Privilege Escalation
- GCP IAM serviceAccounts getAccessToken Privilege Escalation
- GCP IAM serviceAccounts signBlob
- GCP IAM serviceAccounts.signJwt Privilege Escalation
- GCP K8S Privileged Pod Created
- GCP Privilege Escalation via TagBinding
- GCP serviceusage.apiKeys.create Privilege Escalation
- GCP storage hmac keys create
- GCP.Iam.ServiceAccountKeys.Create
- GCP.Privilege.Escalation.By.Deployments.Create
- IAM Assume Role Blocklist Ignored
- IAM Policy Modified
- Kubernetes Privileged Pod Created