T1548 Abuse Elevation Control Mechanism
EnterpriseAdversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-techniques (6)
More specific entries beneath this one.
mitigations
ATT&CK mitigations that reduce this.
detected by (7)
Data components that detect this.
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- PR.PSPlatform Securitymoderate · backed by 9 of 22 mapped controls
- DE.CMContinuous Monitoringmoderate · backed by 7 of 22 mapped controls
- PR.AAIdentity Management, Authentication, and Access Controlmoderate · backed by 6 of 22 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (22)
Security controls that mitigate this.
known-exploited CVEs (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-2783US | —OT critical | KEV | ||
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malic… | ||||
| CVE-2023-44221US | high7.2OT critical | KEV | ||
Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary comm… | ||||
| CVE-2022-1388US | high7.5OT critical | KEV | ||
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x ver… | ||||
| CVE-2022-23131US | critical9.8OT critical | KEV | ||
In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session w… | ||||
attack patterns (4)
CAPEC attack patterns that exploit this.
groups (1)
Threat groups associated with this.
software (1)
Malware and tools associated with this.
Detected by (Sigma) (24)
Sigma detection rules related to this.
source
Where this definition is published.