Home/ MITRE Matrix/ Privilege Escalation/ T1548

T1548Abuse Elevation Control Mechanism

T1548 — Abuse Elevation Control Mechanism is a MITRE ATT&CK technique in the Privilege Escalation tactic. Clankerusecase tracks 18 detection use cases covering it and 3 threat-intel articles citing it.

Privilege Escalation

View on the matrix → Filter Detection Library MITRE official spec ↗

18Use cases

3Articles

6Sub-techniques

1Tactic

Sub-techniques (6)

T1548.002 · Bypass User Account Control T1548.004 · Elevated Execution with Prompt T1548.001 · Setuid and Setgid T1548.003 · Sudo and Sudo Caching T1548.006 · TCC Manipulation T1548.005 · Temporary Elevated Cloud Access

Use cases covering this technique (18)

AWS IAM AdministratorAccess policy applied to a user Internal install · alerting DDCW Azure AD member assigned Global Administrator role Internal install · alerting DD Kubernetes pod created with privileged flag Internal install · alerting DD Splunk Enterprise KV Store Incorrect Authorization ESCU actions · hunting P Allow Operation with Consent Admin ESCU actions · alerting P Linux Persistence and Privilege Escalation Risk Behavior ESCU actions · alerting P Linux Telnet Authentication Bypass ESCU actions · alerting P Services Escalate Exe ESCU actions · alerting P Windows Privilege Escalation Suspicious Process Elevation ESCU actions · alerting P Windows Privilege Escalation System Process Without System Parent ESCU actions · alerting P Windows Privilege Escalation User Process Spawn System Process ESCU actions · alerting P Splunk Edit User Privilege Escalation ESCU actions · hunting P Splunk risky Command Abuse disclosed february 2023 ESCU actions · hunting P Splunk Unauthorized Notification Input by User ESCU actions · hunting P [LLM] IdP self-registration or profile email-change asserting a privileged Budibase user's email Bespoke actions · hunting SP [LLM] FileBrowser proxy-auth header forgery naming admin on /api/login Bespoke exploit · alerting SΣPDD [LLM] FileBrowser post-bypass admin API actions (DELETE/PUT /api/users, /api/settings) Bespoke actions · hunting SΣP [LLM] Fission Environment CRD create/update with dangerous SecurityContext on standalone container (CVE-2026-50566) Bespoke exploit · alerting SΣPDD

Articles citing this technique (3)

crit [GHSA / CRITICAL] GHSA-hp6v-6jw7-gv2f: Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verifie art-84

crit [GHSA / CRITICAL] CVE-2026-54089: File Browser: Authentication Bypass via Proxy Auth Header Forgery art-204

crit [GHSA / CRITICAL] CVE-2026-50566: Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod art-282