“mitre-t1548”的搜索结果

Investigate suspicious privilege increases, including Windows UAC approval bypasses and Linux sudo or setuid abuse. Use registry changes, process relationships, and permission changes to identify possible abuse and document affected hosts, methods, and risk levels.

中文简介正在准备中。当前显示英语简介。

• Investigating Windows UAC bypass activity
• Tracing how administrative access was obtained
• Monitoring Linux sudo and setuid abuse

Detect abuse of elevation control mechanisms including UAC bypass, sudo exploitation, and setuid/setgid manipulation by monitoring registry modifications, process elevation flags, and unusual parent-child process relationships.

中文简介正在准备中。当前显示原文说明。