Threadlinqs IntelligenceStart free

ATT&CK techniquePrivilege Escalation (Mobile)

T1626 Abuse Elevation Control Mechanism

Privilege Escalation (Mobile)Mobile

As of 2026-10-05, T1626 (Abuse Elevation Control Mechanism) appears in 14 tracked threats, first reported 2026-05-11 and most recently 2026-09-28; it most often appears alongside T1513 (Screen Capture).

Tracked threats
142 critical, 11 high, 1 medium
First seen
2026-05-11
Last seen
2026-09-28
Threat actors
—None attributed yet
Detection rules
29Blue tier and above

Data as of:

Activity timeline

T1626 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-09 with 5 reports, and 14 of the 14 threats were reported in the twelve months to 2026-09.

How adversaries use it

T1626 Abuse Elevation Control Mechanism is catalogued by MITRE ATT&CK under the Privilege Escalation (Mobile) tactic in the Mobile matrix. Threadlinqs maps 14 of 2623 tracked threats (0.5%) to it; by severity that is 2 critical, 11 high, 1 medium.

Threats that use T1626 most often also use T1513 Screen Capture (12 threats), T1417 Input Capture (10 threats), T1541 Foreground Persistence (10 threats), T1660 Phishing (10 threats), T1418 Software Discovery (9 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

Mitigations

MITRE ATT&CK lists 1 mitigation for T1626.

Tracked threats

14 tracked threats use T1626.

Detection coverage

Threadlinqs maintains 29 detection rules mapped to T1626 (SPL 12, KQL 8, Sigma 9). Rule content is available to Blue tier accounts and above; this page shows counts only.

29 detection rules (SPL/KQL/Sigma) · Blue and above. Compare plans

Sub-techniques

  • T1626.001 Device Administrator Permissions — 5 tracked threats