Cross-source coverage

T1548 / ATT&CK

Abuse Elevation Control Mechanism

361 rules · 340 families across 11 sources.

6 deprecated hidden · include

From MITRE ATT&CK 19.2

Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.

Platforms
Linux · macOS · Windows · IaaS · Office Suite · Identity Provider
Telemetry
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLmacos:unifiedlogfs:fsusageazure:signinlogsAWS:CloudTrail

How MITRE says to detect it DET0345

Detection Strategy for Abuse Elevation Control Mechanism (T1548)

Windows Analytic 0975

Correlate registry modifications (e.g., UAC bypass registry keys), unusual parent-child process relationships (e.g., control.exe spawning cmd.exe), and unsigned elevated process executions with non-standard tokens or elevation flags.

  • WinEventLog:Security EventCode=4688
  • WinEventLog:Security EventCode=4672
  • WinEventLog:Sysmon EventCode=13, 14

Linux Analytic 0976

Monitor audit logs for setuid/setgid bit changes, executions where UID ≠ EUID (indicative of sudo or privilege escalation), and high-integrity binaries launched by unprivileged users.

  • auditd:SYSCALL setuid or setgid bit changes
  • auditd:SYSCALL execve with UID ≠ EUID
  • auditd:SYSCALL sudo or pkexec invocation

macOS Analytic 0977

Detect execution of `/usr/libexec/security_authtrampoline` or use of AuthorizationExecuteWithPrivileges API, and monitor process lineage for unusual launches of GUI apps with escalated privileges.

  • macos:unifiedlog authorization execute privilege requests
  • auditd:SYSCALL execve with escalated privileges
  • fs:fsusage binary execution of security_authtrampoline

Identity Provider Analytic 0978

Monitor for unexpected privilege elevation operations via SAML assertion manipulation, role injection, or changes to identity mappings that result in access escalation.

  • azure:signinlogs unusual role assumption or elevation path

IaaS Analytic 0979

Detect sudden privilege escalations such as IAM role changes, user-assigned privilege boundaries, or elevation via assumed roles beyond normal behavior.

  • AWS:CloudTrail role privilege expansion detected
  • AWS:CloudTrail cross-account or unexpected assume role

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 361 above — a rule tagged a sub-technique covers this technique too.

SigmaHQ/sigma

85 rules
Detection Severity Format
HackTool - Empire PowerShell UAC Bypass Critical Sigma
Sudo Privilege Escalation CVE-2019-14287 - Builtin Critical Sigma
TrustedPath UAC Bypass Pattern Critical Sigma
Abused Debug Privilege by Arbitrary Parent Processes High Sigma
Bypass UAC Using DelegateExecute High Sigma
Bypass UAC Using SilentCleanup Task High Sigma
Bypass UAC via CMSTP High Sigma
Bypass UAC via Fodhelper.exe High Sigma
Bypass UAC via WSReset.exe High Sigma
CMSTP UAC Bypass via COM Object Access High Sigma

+ 75 more from SigmaHQ/sigma → showing the 10 highest-severity

elastic/detection-rules

73 rules
Detection Severity Format
AWS EC2 Instance Profile Associated with Running Instance High Elastic TOML
AWS STS AssumeRoot by Rare User and Member Account High Elastic TOML
AWS STS GetFederationToken with AdministratorAccess in Request High Elastic TOML
Bypass UAC via Event Viewer High Elastic TOML
Potential Copy Fail (CVE-2026-31431) Exploitation via AF_ALG Socket High Elastic TOML
Potential CVE-2025-32463 Sudo Chroot Execution Attempt High Elastic TOML
Potential Privacy Control Bypass via Localhost Secure Copy High Elastic TOML
Potential Privilege Escalation via a Parent/Child Process Sequence High Elastic TOML
Potential Privilege Escalation via a Parent Process Sequence High Elastic TOML
Potential Privilege Escalation via a Suspicious UID Change High Elastic TOML

+ 63 more from elastic/detection-rules → showing the 10 highest-severity

splunk/security_content

67 rules
Detection Severity Format
Allow Operation with Consent Admin Undefined SPL
Disable UAC Remote Restriction Undefined SPL
Disabling Remote User Account Control Undefined SPL
Eventvwr UAC Bypass Undefined SPL
FodHelper UAC Bypass Undefined SPL
Linux APT Privilege Escalation Undefined SPL
Linux Auditd Doas Conf File Creation Undefined SPL
Linux Auditd Doas Tool Execution Undefined SPL
Linux Auditd Nopasswd Entry In Sudoers File Undefined SPL
Linux Auditd Possible Access To Sudoers File Undefined SPL

+ 57 more from splunk/security_content → showing the 10 highest-severity

elastic/protections-artifacts

46 rules
Detection Severity Format
Elevated Apple Script Execution via Unsigned Parent Undefined Elastic TOML
ExecuteWithPrivileges Prompt via Unsigned or Untrusted Application Undefined Elastic TOML
Execution via Electron Child Process Node.js Module Undefined Elastic TOML
Potential PackageKit TOCTOU Privilege Escalation via CVE-2026-41651 Undefined Elastic TOML
Potential Privacy Control Bypass via Localhost Secure Copy Undefined Elastic TOML
Potential Privilege Escalation via a Known SUID/SGID Binary Undefined Elastic TOML
Potential Privilege Escalation via a SUID/SGID Binary Undefined Elastic TOML
Potential Privilege Escalation via Elevated IFileOperation Undefined Elastic TOML
Potential Privilege Escalation via SUID Binary Undefined Elastic TOML
Potential Privilege Escalation via SUID/SGID Proxy Execution Undefined Elastic TOML

+ 36 more from elastic/protections-artifacts → showing the 10 highest-severity

socfortress/Wazuh-Rules

36 rules · 32 families
Detection Severity Format
Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges. 2 variants High Wazuh XML
Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges. 2 variants High Wazuh XML
Ownership of file in /tmp changed to root (T1548.001) High Wazuh XML
Powershell script: UAC bypass cmdlet detected High Wazuh XML
Setuid capability added to binary using setcap (T1548.001) High Wazuh XML
Setuid or Setgid permission set via chmod (T1548.001) High Wazuh XML
Sudo configuration change to disable password timeout (T1548.003) High Wazuh XML
Sudo configuration modified to disable tty_tickets (T1548.003) High Wazuh XML
Sudoers file modified via echo (tty_tickets disabled) (T1548.003) High Wazuh XML
Sysmon - Event 1: Process creation · computerdefaults.exe UAC Bypass (T1548.002) High Wazuh XML

+ 26 more from socfortress/Wazuh-Rules → showing the 10 highest-severity

panther-labs/panther-analysis

20 rules
Detection Severity Format
GCP CloudBuild Potential Privilege Escalation High Panther Python
GCP cloudfunctions functions create High Panther Python
GCP cloudfunctions functions update High Panther Python
GCP Cloud Run Service Created WITH Set IAM Policy High Panther Python
GCP compute.instances.create Privilege Escalation High Panther Python
GCP.Iam.ServiceAccountKeys.Create High Panther Python
GCP IAM serviceAccounts getAccessToken Privilege Escalation High Panther Python
GCP IAM serviceAccounts signBlob High Panther Python
GCP IAM serviceAccounts.signJwt Privilege Escalation High Panther Python
GCP K8S Privileged Pod Created High Panther Python

+ 10 more from panther-labs/panther-analysis → showing the 10 highest-severity

Wazuh Core Ruleset

18 rules
Detection Severity Format
Powershell launched with a integrity level by · win.eventdata.parentImage = (?i)control\.exe, win.eventdata.integrityLevel = (?i)high Critical Wazuh XML
Powershell process invoked known auto-elevated utility , may have been used to bypass UAC · win.eventdata.parentCommandLine = (?i)powershell\.EXE Critical Wazuh XML
added to the registry a subkey associated with UAC bypass by auto-elevated processes · win.eventdata.image = (?i)(cmd|powershell)\.exe High Wazuh XML
Auditd: User becomes root. High Wazuh XML
Command interpreter added to registry key associated to UAC bypass by auto-elevated processes High Wazuh XML
Known auto-elevated utility may have been used to bypass UAC · win.eventdata.originalFileName = (?i)(ComputerDefaults|fodhelper)\.EXE High Wazuh XML
Possible use of fodhelper.exe used to bypass UAC and execute of malicious software High Wazuh XML
Three failed attempts to run sudo High Wazuh XML
Modified registry key associated to UAC bypass by auto-elevated processes Medium Wazuh XML
syslog: Illegal root login. Medium Wazuh XML

+ 8 more from Wazuh Core Ruleset → showing the 10 highest-severity

Azure/Azure-Sentinel

6 rules
Detection Severity Format
Detecting Impossible travel with mailbox permission tampering & Privilege Escalation attempt Medium KQL
Potential Fodhelper UAC Bypass (ASIM Version) Medium KQL
Account Added to Privileged PIM Group Undefined KQL
Entra ID group adds in the last 7 days Undefined KQL
Entra ID role adds in the last 7 days Undefined KQL
VMWare-LPE-2022-22960 Undefined KQL

chainguard-dev/osquery-defense-kit

5 rules · 3 families
Detection Severity Format
Find processes that run with a lower effective UID than their parent (event-based) 2 variants Undefined osquery SQL
Find processes that run with a lower effective UID than their parent (event-based) 2 variants Undefined osquery SQL
Find processes that run with a lower effective UID than their parent (state-based) 2 variants Undefined osquery SQL
Find processes that run with a lower effective UID than their parent (state-based) 2 variants Undefined osquery SQL
Processes running that originate from setuid/setgid programs Undefined osquery SQL

falcosecurity/rules

3 rules
Detection Severity Format
Sudo Potential Privilege Escalation Critical Falco YAML
Non sudo setuid Low Falco YAML
Set Setuid or Setgid bit Low Falco YAML

Bert-JanP/Hunting-Queries-Detection-Rules

2 rules
Detection Severity Format
Hunt for users that have been added to the sudoers group Undefined KQL
MITRE ATT&CK Mapping Undefined KQL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.