MITRE ATT&CKsub-technique

T1548.004 Elevated Execution with Prompt

Published 2020-01-30 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Privilege Escalation
Platforms
macOS
Version
2.0
Created
2020-01-30

Description

Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials. The purpose of this API is to give application developers an easy way to perform operations with root privileges, such as for application installation or updating. This API does not validate that the program requesting root privileges comes from a reputable source or has been maliciously modified. Although this API is deprecated, it still fully functions in the latest releases of macOS. When calling this API, the user will be prompted to enter their credentials but no checks on the origin or integrity of the program are made. The program calling the API may also load world writable files which can be modified to perform malicious behavior with elevated privileges. Adversaries may abuse AuthorizationExecuteWithPrivileges to obtain root privileges in order to install malicious software on victims and install persistence mechanisms. This technique may be combined with Masquerading to trick the user into granting escalated privileges to malicious code. This technique has also been shown to work by modifying legitimate programs present on the machine that make use of this API.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1548 Abuse Elevation Control Mechanism technique

Tactic · MITRE ATT&CK (1)

  • TA0004 Privilege Escalation tactic

Referenced by MITRE ATT&CK · mitigates (1)

  • M1038 Execution Prevention mitigation

Referenced by MITRE ATT&CK · uses (1)

  • S0402 OSX/Shlayer software (malware)

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-654 Credential Prompt Impersonation attack pattern

Referenced by Compliance · mitigates (12)

  • CIS-2.5 Allowlist Authorized Software CIS Safeguard v8.1
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-SC-18 Mobile Code NIST 800-53 control
  • NIST-SC-34 Non-modifiable Executable Programs NIST 800-53 control
  • NIST-SI-12 Information Management and Retention NIST 800-53 control
  • NIST-SI-16 Memory Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References