Adversaries may circumvent mechanisms designed to control elevated privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can gain on a machine. Authorization has to be granted to specific users in order to perform tasks that are designated as higher risk. An adversary can use several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
| ID | Mitigation | Description |
|---|---|---|
| M1013 | Application Developer Guidance |
Applications very rarely require administrator permission. Developers should be cautioned against using this higher degree of access to avoid being flagged as a potentially malicious application. |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0041 | Application Vetting | Permissions Requests |
Application vetting services can detect when an application requests administrator permission. |
| DS0042 | User Interface | Permissions Request |
When an application requests administrator permission, the user is presented with a popup and the option to grant or deny the request. |