Privilege Escalation.

What is privilege escalation?

Privilege escalation means gaining higher-level permissions. MITRE ATT&CK lists it as tactic TA0004 and describes it as the adversary trying to gain higher-level permissions. A tactic is a goal. A technique is one specific way to reach it.

MITRE explains that adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. The tactic covers methods that obtain elevated permissions on a system or network.

How does privilege escalation work?

MITRE says the elevated levels can include SYSTEM or root, local administrator, or a user account with admin-like access. Some techniques MITRE lists under this tactic are:

• Exploitation for Privilege Escalation, T1068: using software vulnerabilities.
• Abuse Elevation Control Mechanism, T1548: getting around safeguards that control elevation.
• Access Token Manipulation, T1134: changing Windows access tokens to run in a different security context.
• Account Manipulation, T1098: changing credentials and permission groups.
• Valid Accounts, T1078: abusing existing legitimate credentials.
• Process Injection, T1055: injecting code into other processes.

MITRE notes that these techniques often overlap with Persistence techniques, because operating system features that let an adversary persist can execute in an elevated context.

Why does it matter?

With more permissions, an attacker can usually do more. MITRE says elevated permissions are needed to follow through on objectives, so stopping escalation can limit what an intruder can do after a first foothold. Spotting an unexpected rise in permissions can also be an early warning sign that something is wrong.

How can you reduce the risk?

MITRE’s Privileged Account Management mitigation focuses on policies, controls and tools to securely manage privileged accounts such as SYSTEM, root or administrative accounts. MITRE’s guidance includes:

• Remove users from the local administrator group on systems.
• On Linux, require a password every time sudo runs, for example by setting the timestamp timeout to 0.
• Do not allow domain administrator accounts to be used for day to day operations that may expose them on unprivileged systems.
• Do not put domain accounts in local administrator groups across systems unless tightly controlled, because this is often equivalent to one local administrator password on all systems.

Is privilege escalation the same as lateral movement?

No. Privilege escalation is about gaining more permissions. Lateral movement is about moving from one system to another. An attacker may do both, but they are separate goals.

Is privilege escalation the same as initial access?

No. Initial access is getting into the network in the first place. Privilege escalation usually comes after, when the attacker already has some foothold and wants more rights.

Related terms on this site include persistence, lateral movement and MITRE ATT&CK.

Related pages in the Knowledge Hub

• Exploitation for Privilege Escalation
• Kerberoasting

Sources

• MITRE ATT&CK: MITRE describes Privilege Escalation (TA0004) as the adversary trying to gain higher-level permissions, often moving from standard user rights to administrator or….
• MITRE ATT&CK: MITRE's Privileged Account Management mitigation focuses on securely managing privileged accounts and advises removing users from local administrator groups,….