Abuse Elevation Control Mechanism
Technique · ATTACK:enterprise:T1548
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1548",
"title": "Abuse Elevation Control Mechanism",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1548",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--67720091-eee3-4d2d-ae16-8264567f6f5b",
"external_id": "T1548",
"domain": "enterprise",
"created": "2020-01-30T13:58:14.373Z",
"modified": "2026-05-12T15:12:00.639Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"privilege-escalation"
],
"source_references": [
{
"source_name": "TechNet How UAC Works",
"url": "https://technet.microsoft.com/en-us/itpro/windows/keep-secure/how-user-account-control-works"
},
{
"source_name": "OSX Keydnap malware",
"url": "https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/"
},
{
"source_name": "Fortinet Fareit",
"url": "https://blog.fortinet.com/2016/12/16/malicious-macro-bypasses-uac-to-elevate-privilege-for-fareit-malware"
},
{
"source_name": "sudo man page 2018",
"url": "https://www.sudo.ws/"
}
]
}Explicit source assertions (16)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:T1548.001 → subtechnique-of → ATTACK:enterprise:T1548
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2d7deb28-0fcf-495b-9d41-01529d356674
ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1548
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--35428082-1010-4e0e-ac4c-9f1426de7796
ATTACK:enterprise:T1548.005 → subtechnique-of → ATTACK:enterprise:T1548
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3dd34032-bef9-4dec-bed4-77b670c70453
ATTACK:enterprise:T1548.002 → subtechnique-of → ATTACK:enterprise:T1548
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4436ace7-a47d-4d18-afa1-4454432fba66
ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1548
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--540937b6-1afd-4f8b-8deb-c1c4f6456ce7
ATTACK:enterprise:M1051 → mitigates → ATTACK:enterprise:T1548
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--58d61052-a04e-4c13-bdd4-a0847956ba70
ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1548
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--650b58f8-3968-420f-94c2-6173fbc600c6
Google Cloud Threat Intelligence ESXi VIBs 2022ATTACK:enterprise:M1052 → mitigates → ATTACK:enterprise:T1548
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6928abb5-b9b1-48d5-b3c5-8c7a94da5076
ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1548
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e024389-346c-489b-a406-1bbdec150eda
ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1548
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8052b9cf-2e89-49c4-a294-4ee42c6c6e03
ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1548
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--94d71c18-e2af-4dfd-aa2f-28ca68a772ab
Github UACMeATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1548
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f30368d-3656-4ba1-8e53-94d5721f9241
TrendMicro RaspberryRobin 2022ATTACK:enterprise:T1548.004 → subtechnique-of → ATTACK:enterprise:T1548
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ac53cb36-9471-4ea0-8316-42d97f84956f
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1548
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b12a23ae-65f6-4226-8124-331ad59d1556
ATTACK:enterprise:T1548.003 → subtechnique-of → ATTACK:enterprise:T1548
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--be444020-9002-42c3-a68c-1591c0d1e9e2
ATTACK:enterprise:T1548.006 → subtechnique-of → ATTACK:enterprise:T1548
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dc8ae1a5-aa85-4388-b175-f05bbf5f0082