TermAttack

Privilege escalation

The attacker moving from the limited rights they have to administrator or system-level rights.

Flow

1Vulnerability exploited
2Control bypassed
3Privileged account used

Related families: —
MITRE ATT&CK: TA0004 · Privilege Escalation
Sources: 7 sources

Overview

MITRE ATT&CK defines privilege escalation as the techniques an attacker uses to gain higher permissions on a system: software vulnerabilities, misconfigurations or bypassing permission controls. MITRE ATT&CK

Another way is to steal the credentials of a privileged account; in that case no technical vulnerability is needed. MITRE ATT&CK

How it works

1
Vulnerability exploited
A vulnerability in the operating system or a driver. MITRE ATT&CK
2
Control bypassed
Consent mechanisms such as User Account Control. MITRE ATT&CK
3
Privileged account used
Logging in with stolen administrator credentials. MITRE ATT&CK

Real-world examples

Administrator rights on a contractor computer

Mandiant noted that in the Snowflake incident, infostealers infecting computers contractors also used for personal tasks could carry IT and administrator-level access. Google Cloud (Mandiant)

How to detect it

An administrator or SYSTEM-level process spawning from a standard user process. MITRE ATT&CK

What to do

Apply security updates on time. MITRE ATT&CK
Do not use administrator accounts for daily work; manage privileged accounts separately. MITRE ATT&CK

MITRE ATT&CK

TA0004Privilege Escalation T1068Exploitation for Privilege Escalation T1548.002Bypass User Account Control T1078Valid Accounts

Related terms

Terms

UAC bypass Lateral movement Zero-day

Sources

1Privilege Escalation (TA0004) · MITRE ATT&CK
2Exploitation for Privilege Escalation (T1068) · MITRE ATT&CK
3Bypass User Account Control (T1548.002) · MITRE ATT&CK
4Valid Accounts (T1078) · MITRE ATT&CK
5UNC5537 targets Snowflake customer instances · Google Cloud (Mandiant), 2024
6Update Software (M1051) · MITRE ATT&CK
7Privileged Account Management (M1026) · MITRE ATT&CK