Elevated Execution with Prompt
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
The single analytic AN1111 offers exactly one Sigma logsource, repeated three times: {product: macos, service: unifiedlog}. That logsource has no field vocabulary anywhere — not in the brief, which gives prose notes ('Execution of /usr/libexec/security_authtrampoline or child processes originating from non-trusted binaries triggering credential prompts') and no field names, not in lib/sigma, which contains no macOS mapping at all, and not in Sigma's own taxonomy, where macOS process events are modelled as {category: process_creation, product: macos} with Image/CommandLine/ParentImage rather than as a unifiedlog service. […]
What the technique is
Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials. The purpose of this API is to give application developers an easy way to perform operations with root privileges, such as for application installation or updating. This API does not validate that the program requesting root privileges comes from a reputable source or has been maliciously modified. Although this API is deprecated, it still fully functions in the latest releases of macOS. When calling this API, the user will be prompted to enter their credentials but no checks on the origin or integrity of the program are made. The program calling the API may also load world writable files which can be modified to perform malicious behavior with elevated privileges. Adversaries may abuse AuthorizationExecuteWithPrivileges to obtain root privileges in order to install malicious software on victims and install persistence mechanisms. This technique may be combined with Masquerading to trick the user into granting escalated privileges to malicious code. This technique has also been shown to work by modifying legitimate programs present on the machine that make use of this API.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN1111
Detects abuse of AuthorizationExecuteWithPrivileges API to gain elevated privileges via user credential prompts, typically through invocation of /usr/libexec/security_authtrampoline. Detection involves correlation of API usage, binary reputation, and prompt context.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.