Abuse Elevation Control Mechanism: Elevated Execution with Prompt `T1548.004`

Tactic: Privilege Escalation

Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials. The purpose of this API is to give application developers an easy way to perform operations with root privileges, such as for application installation or updating. This API does not validate that the program requesting root privileges comes from a reputable source or has been maliciously modified.

Events covered

1 catalog event is tagged with this technique by at least one rule.

Provider	Event	Title
ESF	exec	Process Execution

Authoring guide

These 3 rules share fields, values, and exclusions.

Fields filtered most (10 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`event.type`	3	`in` 2, `eq` 1	`start`, `process_started`
`process_name`	3	`eq` 3	`security_authtrampoline`, `osascript`
`host.os.type`	2	`eq` 2
`process.Ext.effective_parent.executable`	2	`starts_with` 2	`/Applications/`, `/Users/Shared/`, `/Volumes/`, `/private/tmp/`, `/tmp/`
`process.parent.code_signature.exists`	2	`eq` 2	`false`
`process.parent.code_signature.trusted`	2	`eq` 2	`false`
`CommandLine`	1	`wildcard` 1	`osascript*with administrator privileges`
`EventType`	1	`eq` 1	`exec`
`parent_process_name`	1	`wildcard` 1	`bash`, `com.apple.automator.runner`, `dash`
`process.args`	1	`starts_with` 1	`/Applications/`, `/Volumes/`, `auth`

Top indicator values (28 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.type`	`in`	`process_started` elasticApple Scripting Execution with Administrator Privileges elasticExecution with Explicit Credentials via Scripting	2	39
`event.type`	`in`	`start` elasticApple Scripting Execution with Administrator Privileges elasticExecution with Explicit Credentials via Scripting	2	41
`process.parent.code_signature.exists`	`eq`	`false` elasticApple Scripting Execution with Administrator Privileges elasticExecuteWithPrivileges Prompt via Unsigned or Untrusted Application	2	25
`process.parent.code_signature.trusted`	`eq`	`false` elasticApple Scripting Execution with Administrator Privileges elasticExecuteWithPrivileges Prompt via Unsigned or Untrusted Application	2	26
`process_name`	`eq`	`security_authtrampoline` elasticExecuteWithPrivileges Prompt via Unsigned or Untrusted Application elasticExecution with Explicit Credentials via Scripting	2	2
`process_name`	`eq`	`osascript` elasticApple Scripting Execution with Administrator Privileges	1	46
`CommandLine`	`wildcard`	`osascript*with administrator privileges` elasticApple Scripting Execution with Administrator Privileges	1
`EventType`	`eq`	`exec` elasticExecuteWithPrivileges Prompt via Unsigned or Untrusted Application	1	579
`event.type`	`eq`	`start` elasticExecuteWithPrivileges Prompt via Unsigned or Untrusted Application	1	1087
`parent_process_name`	`wildcard`	`bash` elasticExecution with Explicit Credentials via Scripting	1	15
`parent_process_name`	`wildcard`	`com.apple.automator.runner` elasticExecution with Explicit Credentials via Scripting	1
`parent_process_name`	`wildcard`	`dash` elasticExecution with Explicit Credentials via Scripting	1	7
`parent_process_name`	`wildcard`	`osascript` elasticExecution with Explicit Credentials via Scripting	1	12
`parent_process_name`	`wildcard`	`perl*` elasticExecution with Explicit Credentials via Scripting	1	8
`parent_process_name`	`wildcard`	`php*` elasticExecution with Explicit Credentials via Scripting	1	10
`parent_process_name`	`wildcard`	`pwsh` elasticExecution with Explicit Credentials via Scripting	1
`parent_process_name`	`wildcard`	`python*` elasticExecution with Explicit Credentials via Scripting	1	23
`parent_process_name`	`wildcard`	`ruby` elasticExecution with Explicit Credentials via Scripting	1	4
`parent_process_name`	`wildcard`	`sh` elasticExecution with Explicit Credentials via Scripting	1	15
`parent_process_name`	`wildcard`	`zsh` elasticExecution with Explicit Credentials via Scripting	1	15
`process.Ext.effective_parent.executable`	`starts_with`	`/Applications/` elasticExecuteWithPrivileges Prompt via Unsigned or Untrusted Application	1	3
`process.Ext.effective_parent.executable`	`starts_with`	`/Users/Shared/` elasticApple Scripting Execution with Administrator Privileges	1
`process.Ext.effective_parent.executable`	`starts_with`	`/Volumes/` elasticExecuteWithPrivileges Prompt via Unsigned or Untrusted Application	1	3
`process.Ext.effective_parent.executable`	`starts_with`	`/private/tmp/` elasticApple Scripting Execution with Administrator Privileges	1	2
`process.Ext.effective_parent.executable`	`starts_with`	`/tmp/` elasticApple Scripting Execution with Administrator Privileges	1	2
`process.args`	`starts_with`	`/Applications/` elasticExecuteWithPrivileges Prompt via Unsigned or Untrusted Application	1	4
`process.args`	`starts_with`	`/Volumes/` elasticExecuteWithPrivileges Prompt via Unsigned or Untrusted Application	1	6
`process.args`	`starts_with`	`auth` elasticExecuteWithPrivileges Prompt via Unsigned or Untrusted Application	1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: macOS

Domain: Endpoint