T1548 — Abuse Elevation Control Mechanism

# T1548 - Abuse Elevation Control Mechanism

## SOC Recommendation
Investigate Abuse Elevation Control Mechanism activity in the context of Privilege Escalation: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Application Exception Monitoring | Detect | Monitor for Application Exception Monitoring indicators relevant to this technique. |
| File Encryption | Harden | Apply File Encryption to reduce this technique's viability before an incident occurs. |
| File Eviction | Evict | Use File Eviction to remove the adversary's foothold once this technique is confirmed. |
| System Call Filtering | Isolate | Apply System Call Filtering to contain the blast radius once this technique is observed. |

## Investigation Steps
1. PowerShell with encoded command → decode immediately (see GEN-EX-001)
2. A binary in a temp path → submit to VirusTotal
3. A reverse shell one-liner → treat as active C2

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Revert the malicious registry key to its default state (or d | Low | No | Yes |
| Kill any elevated process spawned via the bypass | Low | No | Yes |
| If High integrity process ran: assume privilege escalation s | Low | Yes | No |

## KQL
```kql
let SuspiciousRegistryKeys = dynamic([
    "ms-settings\\shell\\open\\command",
    "mscfile\\shell\\open\\command",
    "Classes\\Folder\\shell\\open\\command",
    "Classes\\exefile\\shell\\runas\\command\\IsolatedCommand",
    "Classes\\.hta\\shell\\open\\command",
    "Classes\\ms-settings\\shell\\open\\command"
]);
DeviceRegistryEvents
| where TimeGenerated >= ago(5m)
| where ActionType == "RegistryValueSet"
| where RegistryKey has_any (SuspiciousRegistryKeys)
| where isnotempty(RegistryValueData)
| project
    TimeGenerated,
    DeviceName,
    DeviceId,
    AccountName,
    AccountDomain,
    RegistryKey,
    RegistryValueName,
    RegistryValueData,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine,
    InitiatingProcessIntegrityLevel,
    InitiatingProcessSHA256
| extend timestamp = TimeGenerated,
         HostCustomEntity = DeviceName,
         AccountCustomEntity = AccountName
| order by TimeGenerated desc
```
```kql
let Threshold = 3;
AzureDiagnostics
| where Category =~ "FrontDoorWebApplicationFirewallLog"
| where action_s =~ "AnomalyScoring"
| where details_msg_s has "Injection" or details_msg_s has "File Inclusion"
| parse details_data_s with MessageText "Matched Data:" MatchedData "AND " * "table_name FROM " TableName " " *
| project trackingReference_s, host_s, requestUri_s, TimeGenerated, clientIP_s, details_matches_s, details_msg_s, details_data_s, TableName, MatchedData
| join kind = inner(
AzureDiagnostics
| where Category =~ "FrontDoorWebApplicationFirewallLog"
| where action_s =~ "Block") on trackingReference_s
| summarize URI_s = make_set(requestUri_s,100), Table = make_set(TableName,100), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TrackingReference = make_set(trackingReference_s,100), Matched_Data = make_set(MatchedData,100), Detail_Data = make_set(details_data_s,100), Detail_Message = make_set(details_msg_s,100), Total_TrackingReference = dcount(trackingReference_s) by clientIP_s, host_s, action_s
| where Total_TrackingReference >= Threshold
```
```kql
let Threshold = 3;
AzureDiagnostics
| where Category =~ "FrontDoorWebApplicationFirewallLog"
| where action_s =~ "AnomalyScoring"
| where details_msg_s has "Path Traversal Attack"
| parse details_data_s with MessageText "Matched Data:" MatchedData "AND " * "table_name FROM " TableName " " *
| project trackingReference_s, host_s, requestUri_s, TimeGenerated, clientIP_s, details_matches_s, details_msg_s, details_data_s, TableName, MatchedData
| join kind = inner(
AzureDiagnostics
| where Category =~ "FrontDoorWebApplicationFirewallLog"
| where action_s =~ "Block") on trackingReference_s
| summarize URI_s = make_set(requestUri_s,100), Table = make_set(TableName,100), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TrackingReference = make_set(trackingReference_s,100), Matched_Data = make_set(MatchedData,100), Detail_Data = make_set(details_data_s,100), Detail_Message = make_set(details_msg_s,100), Total_TrackingReference = dcount(trackingReference_s) by clientIP_s, host_s, action_s
| where Total_TrackingReference >= Threshold
```

## Escalation Criteria
- Abuse Elevation Control Mechanism activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1548.json
• /api/recommendations/T1548.json
• /api/d3fend/T1548.json
• /api/mappings/T1548.json
• /api/confluence/T1548.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1548.json

Response:

{
  "technique_id": "T1548",
  "name": "Abuse Elevation Control Mechanism",
  "priority": "high",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Privilege Escalation"
  ],
  "platforms": [
    "Linux",
    "macOS",
    "Windows",
    "IaaS",
    "Office Suite",
    "Identity Provider"
  ],
  "summary": "Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk...",
  "soc_recommendation": "Investigate Abuse Elevation Control Mechanism activity in the context of Privilege Escalation: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-AEM",
      "name": "Application Exception Monitoring",
      "relationship": "detect",
      "practical_action": "Monitor for Application Exception Monitoring indicators relevant to this technique.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FE",
      "name": "File Encryption",
      "relationship": "harden",
      "practical_action": "Apply File Encryption to reduce this technique's viability before an incident occurs.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FEV",
      "name": "File Eviction",
      "relationship": "evict",
      "practical_action": "Use File Eviction to remove the adversary's foothold once this technique is confirmed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-SCF",
      "name": "System Call Filtering",
      "relationship": "isolate",
      "practical_action": "Apply System Call Filtering to contain the blast radius once this technique is observed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "PowerShell with encoded command → decode immediately (see GEN-EX-001)",
      "A binary in a temp path → submit to VirusTotal",
      "A reverse shell one-liner → treat as active C2"
    ],
    "generic": [
      "Confirm whether the observed abuse elevation control mechanism activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"UAC Bypass via Registry Shell Command\" -- Detects registry changes used by common UAC bypass methods."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Revert the malicious registry key to its default state (or d",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Revert the malicious registry key to its default state (or delete)"
    },
    {
      "name": "Kill any elevated process spawned via the bypass",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "If High integrity process ran: assume privilege escalation s",
      "category": "Response",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "See investigation guide",
      "notes": "If High integrity process ran: assume privilege escalation succeeded — check for LSASS access, persistence, and C2"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "GEN-PE-002 — UAC Bypass via Registry Shell Command",
        "description": "Detects registry changes used by common UAC bypass methods. (Source: Bell Integration baseline detection library, mapped via sub-technique T1548.002.)",
        "query": "let SuspiciousRegistryKeys = dynamic([\n    \"ms-settings\\\\shell\\\\open\\\\command\",\n    \"mscfile\\\\shell\\\\open\\\\command\",\n    \"Classes\\\\Folder\\\\shell\\\\open\\\\command\",\n    \"Classes\\\\exefile\\\\shell\\\\runas\\\\command\\\\IsolatedCommand\",\n    \"Classes\\\\.hta\\\\shell\\\\open\\\\command\",\n    \"Classes\\\\ms-settings\\\\shell\\\\open\\\\command\"\n]);\nDeviceRegistryEvents\n| where TimeGenerated >= ago(5m)\n| where ActionType == \"RegistryValueSet\"\n| where RegistryKey has_any (SuspiciousRegistryKeys)\n| where isnotempty(RegistryValueData)\n| project\n    TimeGenerated,\n    DeviceName,\n    DeviceId,\n    AccountName,\n    AccountDomain,\n    RegistryKey,\n    RegistryValueName,\n    RegistryValueData,\n    InitiatingProcessFileName,\n    InitiatingProcessCommandLine,\n    InitiatingProcessIntegrityLevel,\n    InitiatingProcessSHA256\n| extend timestamp = TimeGenerated,\n         HostCustomEntity = DeviceName,\n         AccountCustomEntity = AccountName\n| order by TimeGenerated desc"
      },
      {
        "name": "ded8168e-c806-4772-af30-10576e0a7529 — AFD WAF - Code Injection",
        "description": "Identifies a match for a Code Injection based attack in the AFD WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements. References: https://owasp.org/www-community/attacks/Code_Injection' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let Threshold = 3;\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| where action_s =~ \"AnomalyScoring\"\n| where details_msg_s has \"Injection\" or details_msg_s has \"File Inclusion\"\n| parse details_data_s with MessageText \"Matched Data:\" MatchedData \"AND \" * \"table_name FROM \" TableName \" \" *\n| project trackingReference_s, host_s, requestUri_s, TimeGenerated, clientIP_s, details_matches_s, details_msg_s, details_data_s, TableName, MatchedData\n| join kind = inner(\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| where action_s =~ \"Block\") on trackingReference_s\n| summarize URI_s = make_set(requestUri_s,100), Table = make_set(TableName,100), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TrackingReference = make_set(trackingReference_s,100), Matched_Data = make_set(MatchedData,100), Detail_Data = make_set(details_data_s,100), Detail_Message = make_set(details_msg_s,100), Total_TrackingReference = dcount(trackingReference_s) by clientIP_s, host_s, action_s\n| where Total_TrackingReference >= Threshold"
      },
      {
        "name": "a4d99328-e4e6-493d-b0d5-57e6f9ddae77 — AFD WAF - Path Traversal Attack",
        "description": "Identifies a match for a Path Traversal based attack in the AFD WAF logs. The threshold value in the query can be changed as per your infrastructure's requirements. References: https://owasp.org/www-community/attacks/Path_Traversal' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let Threshold = 3;\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| where action_s =~ \"AnomalyScoring\"\n| where details_msg_s has \"Path Traversal Attack\"\n| parse details_data_s with MessageText \"Matched Data:\" MatchedData \"AND \" * \"table_name FROM \" TableName \" \" *\n| project trackingReference_s, host_s, requestUri_s, TimeGenerated, clientIP_s, details_matches_s, details_msg_s, details_data_s, TableName, MatchedData\n| join kind = inner(\nAzureDiagnostics\n| where Category =~ \"FrontDoorWebApplicationFirewallLog\"\n| where action_s =~ \"Block\") on trackingReference_s\n| summarize URI_s = make_set(requestUri_s,100), Table = make_set(TableName,100), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), TrackingReference = make_set(trackingReference_s,100), Matched_Data = make_set(MatchedData,100), Detail_Data = make_set(details_data_s,100), Detail_Message = make_set(details_msg_s,100), Total_TrackingReference = dcount(trackingReference_s) by clientIP_s, host_s, action_s\n| where Total_TrackingReference >= Threshold"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "ffd8b5e9-aa63-42b3-aead-6fdb170da9a3 — Suspicious TCC Access Granted for User Folders",
        "description": "(ESQL) Detects when TCC access is granted for multiple user folders like Desktop, Downloads and Documents in quick succession. Many information stealers require TCC permissions to access these locations and will prompt users to grant access for data exfiltration. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "FROM logs-endpoint.events.*\n| WHERE host.os.type == \"macos\" \n    AND event.action == \"tcc_modify\" \n    AND Tcc.right == \"allowed\"\n    AND Tcc.update_type == \"create\"\n    AND Tcc.service IN (\"SystemPolicyDocumentsFolder\", \"SystemPolicyDownloadsFolder\", \"SystemPolicyDesktopFolder\")\n    AND Effective_process.name RLIKE \"(bash|zsh|sh|osascript|python.*|perl.*|ruby.*|node|Terminal|iTerm2|ghostty)\"\n| STATS \n    Esql.grant_count = COUNT(*),\n    Esql.unique_folders = COUNT_DISTINCT(Tcc.service),  \n    Esql.folders = VALUES(Tcc.service)\n  BY Effective_process.entity_id, Effective_process.executable, host.name, user.name\n| WHERE Esql.unique_folders >= 2\n| KEEP Esql.*, Effective_process.entity_id, Effective_process.executable, host.name, user.name"
      },
      {
        "name": "8e7a4f2c-9b3d-4e5a-a1b6-c2d8f7e9b3a5 — Entra ID Actor Token User Impersonation Abuse",
        "description": "(ESQL) Identifies potential abuse of actor tokens in Microsoft Entra ID audit logs. Actor tokens are undocumented backend mechanisms used by Microsoft for service-to-service (S2S) operations, allowing services to perform actions on behalf of users. These tokens appear in logs with the service's display name but the impersonated user's UPN... (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "from logs-azure.auditlogs-* metadata _id, _version, _index\n| where azure.auditlogs.properties.initiated_by.user.displayName in (\n    \"Office 365 Exchange Online\",\n    \"Skype for Business Online\",\n    \"Dataverse\",\n    \"Office 365 SharePoint Online\",\n    \"Microsoft Dynamics ERP\"\n  ) and\n  not azure.auditlogs.operation_name like \"*group*\" and\n  azure.auditlogs.operation_name != \"Set directory feature on tenant\"\n  and azure.auditlogs.properties.initiated_by.user.userPrincipalName rlike \".+@[A-Za-z0-9.]+\\\\.[A-Za-z]{2,}\"\n| keep\n    @timestamp,\n    azure.*,\n    client.*,\n    event.*,\n    source.*,\n    _id,\n    _version,\n    _index"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Abuse Elevation Control Mechanism activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1548 - Abuse Elevation Control Mechanism Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}