Techniques › T1548 › T1548.004
T1548.004 Elevated Execution with Prompt
privilege escalation — macOS · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
0
Sigma rules tagged attack.t1548.004
0
KEV CVEs mapped here
<p>Adversaries may leverage the <code>AuthorizationExecuteWithPrivileges</code> API to escalate privileges by prompting the user for credentials. The purpose of this API is to give application developers an easy way to perform operations with root privileges, such as for application installation or updating. This API does not validate that the program requesting root privileges comes from a reputable source or has been maliciously modified.</p><p>Although this API is deprecated, it still fully functions in the latest releases of macOS. When calling this API, the user will be prompted to enter their credentials but no checks on the origin or integrity of the program are made. The program calling the API may also load world writable files which can be modified to perform malicious behavior with elevated privileges.</p><p>Adversaries may abuse <code>AuthorizationExecuteWithPrivileges</code> to obtain root privileges in order to install malicious software on victims and install persistence mechanisms. This technique may be combined with Masquerading to trick the user into granting escalated privileges to malicious code. This technique has also been shown to work by modifying legitimate programs present on the machine that make use of this API.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0395 macOS AuthorizationExecuteWithPrivileges Elevation Prompt Detection v1.0
AN1111 macOSDetects abuse of AuthorizationExecuteWithPrivileges API to gain elevated privileges via user credential prompts, typically through invocation of /usr/libexec/security_authtrampoline. Detection involves correlation of API usage, binary reputation, and prompt context.macos:unifiedlog
Execution of /usr/libexec/security_authtrampoline or child processes originating from non-trusted binaries triggering credential prompts→ DC0032 Process Creationmacos:unifiedlogCalls to AuthorizationExecuteWithPrivileges() observed via Apple System Logger or security_auditing tools→ DC0021 OS API Executionmacos:unifiedlogUser credential prompt events without associated trusted installer package→ DC0002 User Account AuthenticationTunable:BinaryReputationListTimeWindowPromptContextValidation
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1548.004
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.
Rules tagged at the parent level (attack.t1548) 24
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Sittikorn S, Teoderick Contreras
· 2022-01-20 (modified 2022-12-31) · logsource: product=linux category=file_event · 00eee2a5-fdb0-4746-a21d-e43fbdea5681
Detects the creation of doas.conf file in linux host platform.
Author: Sittikorn S, Teoderick Contreras
· 2022-01-20 · logsource: product=linux category=process_creation · 067d8238-7127-451c-a9ec-fa78045b618b
Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does.
Author: Omkar Gudhate
· 2020-09-27 (modified 2023-09-28) · logsource: product=windows category=registry_set · 07743f65-7ec9-404a-a519-913db7118a8d
Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'
Author: Corissa Koopmans, '@corissalea'
· 2022-07-18 · logsource: product=azure service=auditlogs · 0922467f-db53-4348-b7bf-dee8d0d348c6
Monitor and alert on conditional access changes.
Author: Florent Labouyrie
· 2021-04-30 (modified 2022-10-09) · logsource: product=windows category=process_access · 174afcfa-6e40-4ae9-af64-496546389294
Detects when a process tries to access the memory of svchost to potentially dump credentials.
Author: Corissa Koopmans, '@corissalea'
· 2022-07-19 · logsource: product=azure service=auditlogs · 26e7c5e2-6545-481e-b7e6-050143459635
Monitor and alert on conditional access changes where non approved actor removed CA Policy.
Author: Milad Cheraghi
· 2026-04-28 · logsource: product=linux category=process_creation · 33b3cfb1-574e-44b9-b527-fbf9303b9d7b
Detects attempts of an attacker to enable core dumps for set-user-ID (SUID) processes by modifying the system file /proc/sys/fs/suid_dumpable, typically by setting its value to 1 or 2.
Enabling this feature allows memory dumps (core dumps) of SUID processes, which usually run with elevated privileges.
These dumps may contain sensitive information such as passwords, cryptographic keys or other secrets.
CVE-2025-5054: Information leak via core dumps from SUID binaries using apport.
CVE-2025-4598: Information disclosure in systemd-coredump due to insecure handling of SUID process memory dumps.
Author: Luc Génaux
· 2026-01-24 · logsource: product=linux category=process_creation · 3a716279-c18c-4488-83be-f9ececbfb9fc
Detects the use of the 'setcap' utility to set the 'setgid' capability (cap_setgid) on a binary file.
This capability allows a non privileged process to make arbitrary manipulations of group IDs (GIDs), including setting its current GID to a value that would otherwise be restricted (i.e. GID 0, the root group).
This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.
Author: Corissa Koopmans, '@corissalea'
· 2022-07-19 (modified 2024-05-28) · logsource: product=azure service=auditlogs · 50a3c7aa-ec29-44a4-92c1-fce229eef6fc
Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.
Author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'
· 2022-08-04 · logsource: product=azure service=auditlogs · 665e2d43-70dc-4ccc-9d27-026c9dd7ed9c
Monitor and alert on group membership removal of groups that have CA policy modification access
Author: Elastic, @SBousseaden
· 2022-04-27 (modified 2024-08-13) · logsource: product=windows service=security · 749c9f5e-b353-4b90-a9c1-05243357ca4b
Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account.
This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.
Author: Bryan Lim
· 2024-01-12 · logsource: product=gcp service=gcp.audit · 76737c19-66ee-4c07-b65a-a03301d1573d
Detects the deployment of workloads that are deployed by using the break-glass flag to override Binary Authorization controls.
Author: Florian Roth (Nextron Systems)
· 2021-05-27 (modified 2022-10-09) · logsource: product=windows category=process_creation · 883835a7-df45-43e4-bf1d-4268768afda4
Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe
Author: Austin Songer @austinsonger
· 2021-07-24 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 905d389b-b853-46d0-9d3d-dea0d3a3cd49
Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.
Author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'
· 2022-08-04 · logsource: product=azure service=auditlogs · 91c95675-1f27-46d0-bead-d1ae96b97cd3
Monitor and alert on group membership additions of groups that have CA policy modification access
Author: NVISO
· 2020-09-15 (modified 2022-12-25) · logsource: product=windows service=system · a0cb7110-edf0-47a4-9177-541a4083128a
Detects that a vulnerable Netlogon secure channel connection was allowed, which could be an indicator of CVE-2020-1472.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-07-23 · logsource: product=windows category=file_event · a7f3c891-2e4d-4b6a-9f8c-d5e2a1b04c73
Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path.
These files generally contain various user-specific registry settings and are typically located in the user's profile directory.
Staging these files outside of the standard path can be indicative of an attacker attempting to manipulate user registry settings
for persistence, privilege escalation, or dump user registry hives for credential harvesting.
Author: Austin Songer @austinsonger
· 2021-07-24 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · b45ab1d2-712f-4f01-a751-df3826969807
Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.
Author: Semanur Guneysu @semanurtg, oscd.community
· 2020-10-28 (modified 2022-11-11) · logsource: product=windows category=process_creation · d522eca2-2973-4391-a3e0-ef0374321dae
Detection of unusual child processes by different system processes
Author: Roberto Rodriguez @Cyb3rWard0g, Tim Shelton
· 2019-08-15 (modified 2022-09-18) · logsource: product=windows service=security · dae8171c-5ec6-4396-b210-8466585b53e9
Detects non-system users performing privileged operation os the SCM database
Author: Tim Rauch, Elastic (idea)
· 2022-09-27 · logsource: product=windows category=process_creation · e52cb31c-10ed-4aea-bcb7-593c9f4a315b
Detects attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in
Author: Luc Génaux
· 2026-01-24 · logsource: product=linux category=process_creation · ed447910-bc30-4575-a598-3a2e49516a7a
Detects the use of the 'setcap' utility to set the 'setuid' capability (cap_setuid) on a binary file.
This capability allows a non privileged process to make arbitrary manipulations of user IDs (UIDs), including setting its current UID to a value that would otherwise be restricted (i.e. UID 0, the root user).
This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.
Author: Austin Songer
· 2021-09-22 (modified 2022-12-18) · logsource: product=aws service=cloudtrail · f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e
Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.
Author: Pawel Mazur
· 2021-11-28 (modified 2022-12-25) · logsource: product=linux service=auditd · fe10751f-1995-40a5-aaa2-c97ccb4123fe
Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges.