T1548.004 — Elevated Execution with Prompt

Tactic: Privilege Escalation · Platforms: macOS

Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials. The purpose of this API is to give application developers an easy way to perform operations with root privileges, such as for application installation or updating. This…

Sub-technique of Abuse Elevation Control Mechanism (T1548).

Sigma detection rules (1)

T1548.004 Abuse Elevation Control Mechanism: Elevated Execution with Prompt

title: "T1548.004 Abuse Elevation Control Mechanism: Elevated Execution with Prompt"
id: 34a26aa2-d617-4354-a447-97f3fe64f4cf
description: 'macOS AuthorizationExecuteWithPrivileges Elevation Prompt Detection. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: BinaryReputationList, TimeWindow, PromptContextValidation.'
references:
  - https://attack.mitre.org/techniques/T1548/004
author: Shahrukh Khan
date: 2026-06-23
license: MIT
tags:
  - attack.privilege-escalation
  - attack.t1548.004

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    ParentImage|endswith: '/securityd'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/zsh'
      - '/osascript'
  condition: selection and selection_child

falsepositives:
  - Legitimate applications that use AuthorizationExecuteWithPrivileges to prompt the user for elevated execution generate the same parent-child relationship, so this should be reviewed for whether the child process is unsigned or was not the expected helper tool for the prompting application.

level: high

Related sub-techniques

Explore