Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.(Citation: TechNet How UAC Works)(Citation: sudo man page 2018) An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.(Citation: OSX Keydnap malware)(Citation: Fortinet Fareit)
Abuse Elevation Control Mechanism
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1548  external_id: T1548     source_name: TechNet How UAC Works  description: Lich, B. (2016, May 31). How User Account Control Works. Retrieved June 3, 2016.  url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/how-user-account-control-works     source_name: OSX Keydnap malware  description: Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware is hungry for credentials. Retrieved July 3, 2017.  url: https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/     source_name: Fortinet Fareit  description: Salvio, J., Joven, R. (2016, December 16). Malicious Macro Bypasses UAC to Elevate Privilege for Fareit Malware. Retrieved December 27, 2016.  url: https://blog.fortinet.com/2016/12/16/malicious-macro-bypasses-uac-to-elevate-privilege-for-fareit-malware     source_name: sudo man page 2018  description: Todd C. Miller. (2018). Sudo Man Page. Retrieved March 19, 2018.  url: https://www.sudo.ws/     