Detections
Analytics
Abuse Elevation Control Mechanism
Description
Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Products, Sensors, and Dependencies
| Product | Dependencies | Data source | Access required | Protocol | Data Collected | Notes |
|---|---|---|---|---|---|---|
| Tenable Identity Exposure | Active Directory | Standard AD user | LDAP | User and Group membership and ACL | Plugin ID: C-ROOTOBJECTS-SD-CONSISTENCY |
Attack Path Technique Details
Framework: MITRE ATT&CK
Family: Privilege Escalation, Defense Evasion
Technique: Abuse Elevation Control Mechanism
Platform: Windows
Products Required: Tenable Identity Exposure
Tenable Release Date: 2022 Q3