What MITRE ATT&CK T1548.004: Elevated Execution with Prompt (Enterprise Tactic TA0004 - Privilege Escalation / TA0005 - Defense Evasion) requires
MITRE ATT&CK T1548.004 (Elevated Execution with Prompt) is an Enterprise Privilege Escalation and Defense Evasion sub-technique of T1548 (Abuse Elevation Control Mechanism). Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials. The purpose of this API is to give application developers an easy way to perform operations with root privileges, such as for application installation or updating. This API does not validate that the program requesting root privileges comes from a reputable source or has been maliciously modified. Although this API is deprecated, it still fully functions in the latest releases of macOS. Affected platforms: macOS. MITRE-documented mitigations include M1038 Execution Prevention. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-02, AC-03, AC-05, AC-06, AC-16, CA-07, CM-02, CM-03.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1548/004/
SHA-256 integrity: 9c845dbe5c4243cd7f21297690fadd7652eb1376d49873d12021b020c1bb4392
Primary Citations — 7 traced to source
- MITRE ATT&CK Technique T1548.004: Elevated Execution with Prompt (https://attack.mitre.org/techniques/T1548/004/)
- MITRE ATT&CK Tactic TA0004: Privilege Escalation (https://attack.mitre.org/tactics/TA0004/)
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
⚠ Important: Human Verification Required
Bidda compliance nodes are reference intelligence, not legal advice. Every node must be reviewed by a qualified compliance professional or legal counsel before implementation in any enterprise workflow, regulated system, or compliance programme. See bidda.com/disclaimer for full terms.