Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that
are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher
risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
攻撃者は、特権の昇格を制御するために設計されたメカニズムを回避して、より高いレベルの権限を取得することがあります。大半の最新システムは、ユーザーがマシン上で実行できる権限を制限することを目的とした、昇格制御機構を標準で備えています。より高いリスクとみなされるタスクを実行するためには、特定のユーザーに権限を付与する必要があります。攻撃者は、システム上で権限を昇格させるために、組み込みの制御機構を利用するいくつかの方法を実行することができます。
| ID | Mitigation | Description |
|---|---|---|
| M1047 | Audit |
Check for common UAC bypass weaknesses on Windows systems to be aware of the risk posture and address issues where appropriate.[1] リスク態勢を認識し、必要に応じて問題に対処するためにWindowsシステムで一般的なUAC回避の弱点をチェックする。([1]はチェックツール) |
| M1038 | Execution Prevention |
System settings can prevent applications from running that haven't been downloaded from legitimate repositories which may help mitigate some of these issues. Not allowing
unsigned applications from being run may also mitigate some risk. |
| M1028 | Operating System Configuration |
Applications with known vulnerabilities or known shell escapes should not have the setuid or setgid bits set to reduce potential damage if an application is compromised.
Additionally, the number of programs with setuid or setgid bits set should be minimized across a system. Ensuring that the sudo tty_tickets setting is enabled will prevent
this leakage across tty sessions. |
| M1026 | Privileged Account Management |
Remove users from the local administrator group on systems. By requiring a password, even if an adversary can get terminal access, they must know the password to run anything in the sudoers file. Setting the timestamp_timeout to 0 will require the user to input their password every time sudo is executed. |
| M1022 | Restrict File and Directory Permissions |
The sudoers file should be strictly edited such that passwords are always required and that users can't spawn risky processes as users with higher privilege. |
| M1052 | User Account Control |
Although UAC bypass techniques exist, it is still prudent to use the highest enforcement level for UAC when possible and mitigate bypass opportunities that exist with techniques such as DLL Search Order Hijacking. |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0017 | Command | Command Execution |
Monitor executed commands and arguments that may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. |
| DS0022 | File | File Metadata |
Monitor the file system for files that have the setuid or setgid bits set. On Linux, auditd can alert every time a user's actual ID and effective ID are different (this is what happens when you sudo). |
| File Modification |
On Linux, auditd can alert every time a user's actual ID and effective ID are different (this is what happens when you sudo). This technique is abusing normal functionality in
macOS and Linux systems, but sudo has the ability to log all input and output based on the |
||
| DS0009 | Process | OS API Execution |
Also look for any process API calls for behavior that may be indicative of Process Injection. Monitoring OS API callbacks for the execution can also be a way to detect this behavior but requires specialized security tooling. |
| Process Creation |
Monitor for newly executed processes that may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. |
||
| Process Metadata |
Monitor contextual data about a running process, which may include information such as environment variables, image name, user/owner that may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. |
||
| DS0024 | Windows Registry | Windows Registry Key Modification |
There are many ways to perform UAC bypasses when a user is in the local administrator group on a system, so it may be difficult to target detection on all variations. Efforts should likely be placed on mitigation and collecting enough information on process launches and actions that could be performed before and after a UAC bypass is performed. Some UAC bypass methods rely on modifying specific, user-accessible Registry settings. Analysts should monitor Registry settings for unauthorized changes. |