Privilege Escalation.

What Is Privilege Escalation?

Privilege escalation means gaining higher-level permissions. MITRE ATT&CK lists it as tactic TA0004 and describes it as the adversary trying to gain higher-level permissions. A tactic is a goal. A technique is one specific way to reach it.

MITRE explains that adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. The tactic covers methods that obtain elevated permissions on a system or network.

How Does Privilege Escalation Work?

MITRE says the elevated levels can include SYSTEM or root, local administrator, or a user account with admin-like access. Several techniques reach them, and the table below lists six.

Which Techniques Does MITRE List, and What Does Each One Need?

These six techniques sit under TA0004. The last column holds one fact from MITRE that sets each apart.

MITRE notes that these techniques often overlap with Persistence techniques, because operating system features that let an adversary persist can execute in an elevated context.

What Does an Attacker Gain With Higher Rights?

With more permissions, an attacker can usually do more. MITRE says elevated permissions are needed to follow through on objectives, so stopping escalation can limit what an intruder can do after a first foothold. Spotting an unexpected rise in permissions can also be an early warning sign that something is wrong. A researcher’s November 2026 report of copied database backups shows the pattern in our Philippine agency backup copy report. Namespace tenants reaching cluster-wide rights is covered in seven critical Kyverno CVEs compared.

How Does Privileged Account Management Limit It?

MITRE’s Privileged Account Management mitigation focuses on policies, controls and tools to securely manage privileged accounts such as SYSTEM, root or administrative accounts. MITRE’s guidance includes:

• Remove users from the local administrator group on systems.
• On Linux, require a password every time sudo runs, for example by setting the timestamp timeout to 0.
• Do not allow domain administrator accounts to be used for day to day operations that may expose them on unprivileged systems.
• Do not put domain accounts in local administrator groups across systems unless tightly controlled, because this is often equivalent to one local administrator password on all systems. This matters most in an Active Directory domain.

Is Privilege Escalation the Same as Lateral Movement?

No. Privilege escalation is about gaining more permissions. Lateral movement is about moving from one system to another. An attacker may do both, but they are separate goals.

Is Privilege Escalation the Same as Initial Access?

No. Initial access is getting into the network in the first place. Privilege escalation usually comes after, when the attacker already has some foothold and wants more rights.

Related terms on this site include persistence, lateral movement and MITRE ATT&CK.

Related Pages in the Knowledge Hub

• Exploitation for Privilege Escalation
• Kerberoasting

Sources

• MITRE ATT&CK: MITRE describes Privilege Escalation (TA0004) as the adversary trying to gain higher-level permissions, often moving from standard user rights to administrator or SYSTEM.
• MITRE ATT&CK: MITRE’s Privileged Account Management mitigation advises securing privileged accounts and removing users from local administrator groups.
• MITRE ATT&CK: Exploitation for Privilege Escalation (T1068) in the table.
• MITRE ATT&CK: Abuse Elevation Control Mechanism (T1548) in the table.
• MITRE ATT&CK: Access Token Manipulation (T1134) in the table.
• MITRE ATT&CK: Account Manipulation (T1098) in the table.
• MITRE ATT&CK: Valid Accounts (T1078) in the table.
• MITRE ATT&CK: Process Injection (T1055) in the table.

A current example is CVE-2026-109469, where Microsoft says a user-controlled key in Entra Device Registration let an unauthorized caller elevate privileges over a network.