Abuse Elevation Control Mechanism `T1548`

Tactic: Privilege Escalation

Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.

Events covered

33 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 5	Process terminated
Sysmon	Event ID 7	Image loaded
Sysmon	Event ID 10	ProcessAccess
Sysmon	Event ID 11	FileCreate
Sysmon	Event ID 12	RegistryEvent (Object create and delete)
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 14	RegistryEvent (Key and Value Rename)
Security-Auditing	Event ID 4624	An account was successfully logged on.
Security-Auditing	Event ID 4657	A registry value was modified.
Security-Auditing	Event ID 4663	An attempt was made to access an object.
Security-Auditing	Event ID 4674	An operation was attempted on a privileged object.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4689	A process has exited.
Defender-CloudAppEvents	any	Cloud app activity
Defender-DeviceRegistryEvents	RegistryKeyDeleted	Registry key deleted
Defender-DeviceRegistryEvents	RegistryValueSet	Registry value set
Defender-DeviceRegistryEvents	RegistryValueDeleted	Registry value deleted
Defender-DeviceRegistryEvents	RegistryKeyRenamed	Registry key renamed
Defender-IdentityInfo	any	Identity information
ESF	exec	Process Execution
ESF	open	File Open
Linux-Auditd	Event ID 1300	SYSCALL
Linux-Auditd	Event ID 1302	PATH
Linux-Auditd	Event ID 1307	CWD
Linux-Auditd	Event ID 1309	EXECVE
Linux-Auditd	Event ID 1321	BPRM_FCAPS
Linux-Auditd	Event ID 1327	PROCTITLE
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
NETLOGON	Event ID 5829	The Netlogon service allowed a vulnerable Netlogon secure channel connection.
Sysmon-for-Linux	Event ID 1	Process Create
Sysmon-for-Linux	Event ID 11	File created

Authoring guide

These 366 rules share fields, values, and exclusions.

Fields filtered most (194 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	95	`eq` 78, `in` 19, `ne` 2	`exec`, `start`, `uid_change`, `rename`, `exec_event`
`process_name`	79	`eq` 55, `in` 18, `starts_with` 6, `regex_match` 5, `is_not_null` 3, `ends_with` 2, `contains` 1, `ne` 1	`dllhost.exe`, `bash`, `chmod`, `sudo`, `setcap`
`CommandLine`	67	`contains` 51, `eq` 11, `wildcard` 7, `in` 5, `ends_with` 3, `regex_match` 3, `starts_with` 2, `match` 1	`sudo`, `--eval`, `(?i)ms-settings\x5cshell\x5copen\x5ccommand.+`, `scp 127.0.0.?:/`, `scp localhost:/`
`event.type`	63	`eq` 54, `in` 7, `ne` 2	`start`, `change`, `process_started`, `creation`, `deletion`
`Image`	57	`ends_with` 28, `wildcard` 9, `is_not_null` 7, `contains` 5, `eq` 5, `starts_with` 4, `in` 2	`/dev/shm/`, `/home//`, `.`, `\dism.exe`, `\powershell.exe`
`host.os.type`	54	`eq` 53, `in` 1
`parent_process_name`	48	`eq` 29, `in` 13, `wildcard` 7, `regex_match` 4, `cross_field_compare` 1	`bash`, `.*`, `bun`, `csh`, `dash`
`process.args`	39	`eq` 23, `in` 14, `wildcard` 10, `starts_with` 5, `contains` 2, `regex_match` 1	`+x`, `--command`, `-2000`, `-4000`, `-6000`
`ParentImage`	36	`ends_with` 19, `wildcard` 10, `contains` 3, `eq` 2, `in` 2, `is_not_null` 1, `starts_with` 1	`/dev/shm/`, `/home//`, `./`, `.*`, `\dllhost.exe`
`TargetFilename`	32	`starts_with` 14, `ends_with` 11, `wildcard` 11, `eq` 4, `in` 3, `contains` 2, `regex_match` 1	`c:\users\`, `/etc/doas.conf`, `/etc/sudoers`, `(?i)^c:\\users\\[^\\]+\\ntuser\.dat$`, `.dll`
`EventID`	25	`eq` 25	`4688`, `1`, `4657`, `13`, `4103`
`TargetObject`	23	`contains` 9, `ends_with` 8, `wildcard` 6, `eq` 1	`software\classes\ms-settings\shell\open\command`, `\ms-windows-store`, `\appx82a6gwre4fdg3bt635tn5ctqjf8msdd2\shell\open\command`, `\environment\windir`, `\lowercaselongpath`
`process.Ext.token.integrity_level_name`	23	`eq` 23	`high`, `system`, `medium`
`IntegrityLevel`	22	`eq` 20, `in` 4	`High`, `System`, `Low`, `Medium`
`Details`	20	`eq` 13, `contains` 3, `ends_with` 3, `is_not_null` 2, `regex_match` 1, `starts_with` 1	`0x00000000`, `(empty)`, `.dll`, `0`, `0x00000001`

Top indicator values (2353 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.type`	`eq`	`start` elasticBypass UAC via Event Viewer elasticExecuteWithPrivileges Prompt via Unsigned or Untrusted Application elasticPod or Container Creation with Suspicious Command-Line elasticPotential CVE-2025-32463 Sudo Chroot Execution Attempt elasticPotential PackageKit TOCTOU Privilege Escalation via CVE-2026-41651 elasticPotential Privacy Control Bypass via Localhost Secure Copy elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via CVE-2023-4911 elasticPotential Privilege Escalation via Enlightenment elasticPotential Privilege Escalation via Python cap_setuid elasticPotential Privilege Escalation via Recently Compiled Executable +35 more rules	50	1078
`event.type`	`eq`	`change` elasticDisabling User Account Control via Registry Modification elasticLocal Account TokenFilter Policy Disabled elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via Enlightenment elasticPotential Privilege Escalation via Python cap_setuid elasticPotential Privilege Escalation via Recently Compiled Executable elasticPotential Privilege Escalation via unshare and UID Change elasticPotential Sudo Token Manipulation via Process Injection elasticPrivilege Escalation via CAP_CHOWN/CAP_FOWNER Capabilities elasticPrivilege Escalation via CAP_SETUID/SETGID Capabilities elasticUAC Bypass Attempt via Privileged IFileOperation COM Interface elasticUID Elevation from Previously Unknown Executable	14	94
`EventType`	`eq`	`exec` elasticElevated Apple Script Execution via Unsigned Parent elasticExecuteWithPrivileges Prompt via Unsigned or Untrusted Application elasticExecution via Electron Child Process Node.js Module elasticPotential PackageKit TOCTOU Privilege Escalation via CVE-2026-41651 elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via CVE-2023-4911 elasticPotential Privilege Escalation via Enlightenment elasticPotential Privilege Escalation via Python cap_setuid elasticPotential Privilege Escalation via Recently Compiled Executable elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID +20 more rules	35	576
`EventType`	`eq`	`start` elasticPotential UAC Bypass via IElevatedFactoryServer elasticUAC Bypass Attempt via CDSSync Scheduled Task Hijack elasticUAC Bypass Attempt via Consent DLL Search Order Hijacking elasticUAC Bypass Attempt via DCCW DLL Search Order Hijacking elasticUAC Bypass Attempt via DismCore DLL Side-Loading elasticUAC Bypass Attempt via DLL Side-Loading from Windows Media Player Folder elasticUAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer elasticUAC Bypass Attempt via MMC DLL Search Order Hijacking elasticUAC Bypass Attempt via SilentCleanup Task DLL Search Order Hijacking elasticUAC Bypass Attempt via Windows Directory Masquerading elasticUAC Bypass Attempt via WOW64 Logger DLL Side-Loading elasticUAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface elasticUAC Bypass via ComputerDefaults Execution Hijack elasticUAC Bypass via Control Panel Execution Hijack elasticUAC Bypass via DelegateExecute Registry Modification +10 more rules	25	391
`EventType`	`eq`	`uid_change` elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via Enlightenment elasticPotential Privilege Escalation via unshare and UID Change elasticPotential Sudo Token Manipulation via Process Injection elasticPrivilege Escalation via CAP_SETUID/SETGID Capabilities elasticUID Elevation from Previously Unknown Executable	8	19
`CommandLine`	`contains`	`sudo` splunkLinux APT Privilege Escalation splunkLinux AWK Privilege Escalation splunkLinux Busybox Privilege Escalation splunkLinux c89 Privilege Escalation splunkLinux c99 Privilege Escalation splunkLinux Composer Privilege Escalation splunkLinux Cpulimit Privilege Escalation splunkLinux Csvtool Privilege Escalation splunkLinux Emacs Privilege Escalation splunkLinux Find Privilege Escalation splunkLinux GDB Privilege Escalation splunkLinux Gem Privilege Escalation splunkLinux GNU Awk Privilege Escalation splunkLinux Make Privilege Escalation splunkLinux MySQL Privilege Escalation +7 more rules	22	24
`process.Ext.token.integrity_level_name`	`eq`	`high` elasticUAC Bypass Attempt via CDSSync Scheduled Task Hijack elasticUAC Bypass Attempt via DCCW DLL Search Order Hijacking elasticUAC Bypass Attempt via DismCore DLL Side-Loading elasticUAC Bypass Attempt via DLL Side-Loading from Windows Media Player Folder elasticUAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer elasticUAC Bypass Attempt via MMC DLL Search Order Hijacking elasticUAC Bypass Attempt via SilentCleanup Task DLL Search Order Hijacking elasticUAC Bypass Attempt via Windows Directory Masquerading elasticUAC Bypass Attempt via WOW64 Logger DLL Side-Loading elasticUAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface elasticUAC Bypass via ComputerDefaults Execution Hijack elasticUAC Bypass via Control Panel Execution Hijack elasticUAC Bypass via DiskCleanup Scheduled Task Hijack elasticUAC Bypass via Event Viewer elasticUAC Bypass via FodHelper Execution Hijack +6 more rules	21	22
`IntegrityLevel`	`eq`	`System` sigmaAlways Install Elevated Windows Installer sigmaCMSTP UAC Bypass via COM Object Access sigmaUAC Bypass Abusing Winsat Path Parsing - Process sigmaUAC Bypass Tools Using ComputerDefaults sigmaUAC Bypass Using ChangePK and SLUI sigmaUAC Bypass Using Consent and Comctl32 - Process sigmaUAC Bypass Using Disk Cleanup sigmaUAC Bypass Using DismHost sigmaUAC Bypass Using IDiagnostic Profile sigmaUAC Bypass Using IEInstal - Process sigmaUAC Bypass Using MSConfig Token Modification - Process sigmaUAC Bypass Using NTFS Reparse Point - Process sigmaUAC Bypass Using PkgMgr and DISM sigmaUAC Bypass Using Windows Media Player - Process sigmaUAC Bypass WSReset +4 more rules	19	30
`IntegrityLevel`	`eq`	`High` sigmaCMSTP UAC Bypass via COM Object Access sigmaPotential UAC Bypass Via Sdclt.EXE sigmaUAC Bypass Abusing Winsat Path Parsing - Process sigmaUAC Bypass Tools Using ComputerDefaults sigmaUAC Bypass Using ChangePK and SLUI sigmaUAC Bypass Using Consent and Comctl32 - Process sigmaUAC Bypass Using Disk Cleanup sigmaUAC Bypass Using DismHost sigmaUAC Bypass Using IDiagnostic Profile sigmaUAC Bypass Using IEInstal - Process sigmaUAC Bypass Using MSConfig Token Modification - Process sigmaUAC Bypass Using NTFS Reparse Point - Process sigmaUAC Bypass Using PkgMgr and DISM sigmaUAC Bypass Using Windows Media Player - Process sigmaUAC Bypass WSReset +1 more rules	16	21
`event.outcome`	`eq`	`success` elasticAWS EC2 Instance Profile Associated with Running Instance elasticAWS IAM Customer Managed Policy Version Created or Default Version Set elasticAWS IAM Customer-Managed Policy Attached to Role by Rare User elasticAWS KMS Key Policy Updated via PutKeyPolicy elasticAWS STS AssumeRole with New MFA Device elasticAWS STS AssumeRoot by Rare User and Member Account elasticAWS STS GetFederationToken with AdministratorAccess in Request elasticAWS STS GetSessionToken Usage elasticAWS STS Role Assumption by Service elasticAWS STS Role Assumption by User elasticAWS STS Role Chaining elasticPrivilege Escalation via CAP_CHOWN/CAP_FOWNER Capabilities	12	369
`user.id`	`ne`	`0` elasticPotential Copy Fail (CVE-2026-31431) Exploitation via AF_ALG Socket elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via Python cap_setuid elasticPotential Privilege Escalation via Recently Compiled Executable elasticPotential Privilege Escalation via unshare and UID Change elasticPotential SUID/SGID Files Enumeration elasticPrivilege Escalation via CAP_CHOWN/CAP_FOWNER Capabilities elasticPrivilege Escalation via CAP_SETUID/SETGID Capabilities elasticPrivilege Escalation via GDB CAP_SYS_PTRACE elasticSuspicious SUID Binary Execution (Auditd Sequence)	12	28
`user.id`	`eq`	`0` elasticPotential PackageKit TOCTOU Privilege Escalation via CVE-2026-41651 elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via Enlightenment elasticPotential Privilege Escalation via Python cap_setuid elasticPotential Privilege Escalation via Recently Compiled Executable elasticPotential Privilege Escalation via unshare and UID Change elasticPrivilege Escalation via CAP_SETUID/SETGID Capabilities elasticPrivilege Escalation via GDB CAP_SYS_PTRACE elasticUID Elevation from Previously Unknown Executable	11	28
`EventID`	`eq`	`4688` splunkComputerDefaults UAC Bypass (Windows Event Log) splunkConsentPromptBehaviorAdmin Registry Value Modified (Windows Event Log) splunkEnableLUA Registry Value Modified (Windows Event Log) splunkIndirect Command Execution (Windows Event Log) splunkMock System Directory - Windows (Windows Event Log) splunkPotential fodhelper UAC Bypass Attempt (Windows Event Log) splunkPromptOnSecureDesktop Registry Value Modified (Windows Event Log) splunkSuspicious ComputerDefaults.exe Execution (Windows Event Log) kustoPotential Fodhelper UAC Bypass kustoPowershell Empire Cmdlets Executed in Command Line	10	317
`EventID`	`eq`	`1` splunkComputerDefaults UAC Bypass (Sysmon) splunkConsentPromptBehaviorAdmin Registry Value Modified (Sysmon) splunkEnableLUA Registry Value Modified (Sysmon) splunkMock System Directory - Windows (Sysmon) splunkPotential fodhelper UAC Bypass Attempt (Sysmon) splunkPromptOnSecureDesktop Registry Value Modified (Sysmon) splunkSuspicious ComputerDefaults.exe Execution (Sysmon) splunkWindows Privilege Escalation System Process Without System Parent	8	241
`parent_process_name`	`in`	`bash` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSudo Command Enumeration Detected elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution elasticSuspicious Symbolic Link Created elasticUID Elevation from Previously Unknown Executable elasticUnusual Pkexec Execution	10	65
`parent_process_name`	`in`	`csh` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSudo Command Enumeration Detected elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution elasticSuspicious Symbolic Link Created elasticUID Elevation from Previously Unknown Executable elasticUnusual Pkexec Execution	10	39
`parent_process_name`	`in`	`dash` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSudo Command Enumeration Detected elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution elasticSuspicious Symbolic Link Created elasticUID Elevation from Previously Unknown Executable elasticUnusual Pkexec Execution	10	42
`parent_process_name`	`in`	`fish` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSudo Command Enumeration Detected elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution elasticSuspicious Symbolic Link Created elasticUID Elevation from Previously Unknown Executable elasticUnusual Pkexec Execution	10	40
`parent_process_name`	`in`	`ksh` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSudo Command Enumeration Detected elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution elasticSuspicious Symbolic Link Created elasticUID Elevation from Previously Unknown Executable elasticUnusual Pkexec Execution	10	40
`parent_process_name`	`in`	`sh` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSudo Command Enumeration Detected elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution elasticSuspicious Symbolic Link Created elasticUID Elevation from Previously Unknown Executable elasticUnusual Pkexec Execution	10	65
`parent_process_name`	`in`	`tcsh` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSudo Command Enumeration Detected elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution elasticSuspicious Symbolic Link Created elasticUID Elevation from Previously Unknown Executable elasticUnusual Pkexec Execution	10	40
`parent_process_name`	`in`	`zsh` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticSudo Command Enumeration Detected elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution elasticSuspicious Symbolic Link Created elasticUID Elevation from Previously Unknown Executable elasticUnusual Pkexec Execution	10	63
`process.group.id`	`eq`	`0` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPotential Sudo Token Manipulation via Process Injection elasticPrivilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution	10	10
`process.user.id`	`eq`	`0` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPotential Sudo Token Manipulation via Process Injection elasticPrivilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution	10	10
`process.real_group.id`	`ne`	`0` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPrivilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution	9	9
`process.real_user.id`	`ne`	`0` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPrivilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution	9	9
`process_name`	`eq`	`dllhost.exe` elasticPotential Privilege Escalation via Elevated IFileOperation elasticPotential UAC Bypass via IElevatedFactoryServer elasticUAC Bypass Attempt via Consent DLL Search Order Hijacking elasticUAC Bypass Attempt via DCCW DLL Search Order Hijacking elasticUAC Bypass Attempt via DismCore DLL Side-Loading elasticUAC Bypass Attempt via DLL Side-Loading from Windows Media Player Folder elasticUAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer elasticUAC Bypass Attempt via Privileged IFileOperation COM Interface elasticUAC Bypass via Windows Firewall Snap-In Hijack	9	19
`EventType`	`in`	`exec` elasticPod or Container Creation with Suspicious Command-Line elasticPotential CVE-2025-32463 Sudo Chroot Execution Attempt elasticPotential Root Effective Shell from Non-Standard Path via Auditd elasticPotential Sudo Privilege Escalation via CVE-2019-14287 elasticProcess Capability Set via setcap Utility elasticSetcap setuid/setgid Capability Set elasticSudo Command Enumeration Detected elasticUnusual Pkexec Execution	8	201
`ParentImage`	`wildcard`	`/dev/shm/*` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution	8	17
`ParentImage`	`wildcard`	`/home//` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via SUID/SGID elasticSuspicious SUID Binary Execution elasticSuspicious SUID/SGID Utility Execution	8	18

Exclusions (701 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`Image`	`eq`	`?:\windows\system32\werfault.exe` elasticUAC Bypass Attempt via Consent DLL Search Order Hijacking elasticUAC Bypass Attempt via DCCW DLL Search Order Hijacking elasticUAC Bypass Attempt via DismCore DLL Side-Loading elasticUAC Bypass Attempt via MMC DLL Search Order Hijacking elasticUAC Bypass Attempt via WOW64 Logger DLL Side-Loading elasticUAC Bypass via ComputerDefaults Execution Hijack elasticUAC Bypass via FodHelper Execution Hijack elasticUAC Bypass via ICMLuaUtil Elevated COM Interface elasticUAC Bypass via Malicious MMC Snap-In Execution elasticUAC Bypass via Sdclt elasticUAC Bypass via Windows Activation Execution Hijack elasticUAC Bypass via Windows Firewall Snap-In Hijack elasticUAC Bypass via WSReset Execution Hijack	13
`Image`	`eq`	`?:\windows\syswow64\werfault.exe` elasticUAC Bypass Attempt via Consent DLL Search Order Hijacking elasticUAC Bypass Attempt via DCCW DLL Search Order Hijacking elasticUAC Bypass Attempt via DismCore DLL Side-Loading elasticUAC Bypass Attempt via MMC DLL Search Order Hijacking elasticUAC Bypass Attempt via WOW64 Logger DLL Side-Loading elasticUAC Bypass via ComputerDefaults Execution Hijack elasticUAC Bypass via FodHelper Execution Hijack elasticUAC Bypass via ICMLuaUtil Elevated COM Interface elasticUAC Bypass via Malicious MMC Snap-In Execution elasticUAC Bypass via Sdclt elasticUAC Bypass via Windows Activation Execution Hijack elasticUAC Bypass via Windows Firewall Snap-In Hijack elasticUAC Bypass via WSReset Execution Hijack	13
`Image`	`eq`	`?:\windows\system32\wermgr.exe` elasticUAC Bypass Attempt via Consent DLL Search Order Hijacking elasticUAC Bypass Attempt via DismCore DLL Side-Loading elasticUAC Bypass Attempt via WOW64 Logger DLL Side-Loading elasticUAC Bypass via ICMLuaUtil Elevated COM Interface elasticUAC Bypass via Sdclt elasticUAC Bypass via Windows Firewall Snap-In Hijack	6
`Image`	`eq`	`?:\windows\syswow64\wermgr.exe` elasticUAC Bypass Attempt via Consent DLL Search Order Hijacking elasticUAC Bypass Attempt via DismCore DLL Side-Loading elasticUAC Bypass Attempt via WOW64 Logger DLL Side-Loading elasticUAC Bypass via ICMLuaUtil Elevated COM Interface elasticUAC Bypass via Sdclt elasticUAC Bypass via Windows Firewall Snap-In Hijack	6
`Image`	`eq`	`?:\windows\system32\conhost.exe` elasticUAC Bypass Attempt via DismCore DLL Side-Loading elasticUAC Bypass Attempt via WOW64 Logger DLL Side-Loading elasticUAC Bypass via WSReset Execution Hijack	3
`process.code_signature.trusted`	`eq`	`true` elasticUAC Bypass Attempt via CDSSync Scheduled Task Hijack elasticUAC Bypass Attempt via DismCore DLL Side-Loading elasticUAC Bypass Attempt via SilentCleanup Task DLL Search Order Hijacking elasticUAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface elasticUAC Bypass via DelegateExecute Registry Modification elasticUAC Bypass via ICMLuaUtil Elevated COM Interface elasticUAC Bypass via Unsafe Deserialization in Event Viewer	7
`Image`	`in`	`/usr/bin/sudo` elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change elasticPrivilege Escalation via CAP_SETUID/SETGID Capabilities	4
`Image`	`in`	`/bin/sudo` elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change	3
`Image`	`wildcard`	`?:\program files (x86)\*.exe` elasticUAC Bypass via DelegateExecute Registry Modification elasticUAC Bypass via Event Viewer elasticUAC Bypass via Unsafe Deserialization in Event Viewer	3
`Image`	`wildcard`	`?:\program files\*.exe` elasticUAC Bypass via DelegateExecute Registry Modification elasticUAC Bypass via Event Viewer elasticUAC Bypass via Unsafe Deserialization in Event Viewer	3
`Image`	`wildcard`	`?:\windows\system32\mmc.exe` elasticBypass UAC via Event Viewer elasticUAC Bypass via Event Viewer elasticUAC Bypass via Unsafe Deserialization in Event Viewer	3
`Image`	`wildcard`	`?:\windows\syswow64\mmc.exe` elasticBypass UAC via Event Viewer elasticUAC Bypass via Event Viewer elasticUAC Bypass via Unsafe Deserialization in Event Viewer	3
`ParentImage`	`wildcard`	`/tmp/newroot/*` elasticProcess Capability Set via setcap Utility elasticSUID/SGID Bit Set elasticSystem Binary Path File Permission Modification	3
`aws::userIdentity.type`	`eq`	`awsservice` elasticAWS EC2 Instance Profile Associated with Running Instance elasticAWS IAM Customer Managed Policy Version Created or Default Version Set elasticAWS KMS Key Policy Updated via PutKeyPolicy	3
`dll.code_signature.subject_name`	`starts_with`	`Microsoft` elasticPotential Privilege Escalation via Elevated IFileOperation elasticUAC Bypass Attempt via WOW64 Logger DLL Side-Loading elasticUAC Bypass via Hijacking WinMgmt MMC	3

Abuse Elevation Control Mechanism `T1548`

Events covered

Authoring guide

Fields filtered most (194 distinct)

Top indicator values (2353 distinct)

Exclusions (701 distinct)

Rules under this technique

Sigma 90 rules

Elastic 120 rules

Splunk 90 rules

Kusto 46 rules

Panther 20 rules

Abuse Elevation Control Mechanism T1548

Events covered

Authoring guide

Fields filtered most (194 distinct)

Top indicator values (2353 distinct)

Exclusions (701 distinct)

Rules under this technique

Sigma 90 rules

Elastic 120 rules

Splunk 90 rules

Kusto 46 rules

Panther 20 rules

Abuse Elevation Control Mechanism `T1548`