Log in Request a demo

Attack technique

Exploitation for Privilege Escalation

Exploitation for privilege escalation is when an attacker uses a flaw in software to gain higher permissions than they started with.

In short

Exploitation for privilege escalation is when an attacker uses a flaw in software to gain higher permissions than they started with. For example, they may go from a normal user account to full control of the system. The flaw can be in the operating system, in software running with higher permissions, or in a signed driver. MITRE ATT&CK tracks it as T1068.

Last updated 8 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact

Privilege Escalation · Step 6 Of 15 In The Attack Chain

  1. MITRE IDT1068ATT&CK technique
  2. Detection4ways to spot itWatch for container breakout · Detection strategy MITRE lists
  3. Defences4ways to stop itBlock known vulnerable drivers · Patch regularly

How it works

An attacker often first lands in a process with limited rights, which blocks access to some resources. Flaws in the operating system or in software running with higher permissions can let them break out of that limit and reach SYSTEM or root level. MITRE also notes this can be used to escape virtual environments such as containers. An October 2026 report, Tailworm, describes a claimed root escalation in the SSH server built into a remote-access tool; it is the researcher’s lab result, not confirmed by the vendor.

One variant uses drivers. MITRE says an attacker may bring a signed vulnerable driver onto a compromised machine and exploit it to run code in kernel mode. MITRE says this is “sometimes referred to as Bring Your Own Vulnerable Driver (BYOVD)” (source: MITRE ATT&CK T1068). The driver may arrive with the files used for initial access, or be downloaded or copied across the network later.

Sophos says affiliates of The Gentlemen ransomware program use BYOVD to escalate privileges and end endpoint detection and response (EDR) processes (source: Sophos). Our profile explains how The Gentlemen affiliates disable EDR with vulnerable drivers.

A real example

MITRE ATT&CK lists these procedure examples:

  • Carberp has exploited several Windows vulnerabilities and a .NET Runtime Optimization vulnerability for privilege escalation.
  • Cobalt Strike can exploit vulnerabilities such as MS14-058.
  • Stuxnet used MS10-073 and an undisclosed Task Scheduler vulnerability to escalate privileges on local Windows machines.

How to detect

  1. Watch for kernel driver and OS component exploitation

    Look for signs that a vulnerable kernel driver or operating system component was exploited, followed by unusual process or token behavior.

  2. Watch for odd behavior on Linux and macOS

    MITRE describes detections for vulnerable setuid programs and kernel modules on Linux, and for vulnerable kernel extensions on macOS.

  3. Watch for container breakout

    Look for a process that escapes a container and then interacts with the host or gains extra capabilities.

  4. Detection strategy MITRE lists

    DET0514, Detection Strategy for Exploitation for Privilege Escalation.

How to defend

  1. Block known vulnerable drivers

    Consider blocking the execution of known vulnerable drivers that attackers could use to run code in kernel mode.

  2. Patch regularly

    Run regular patch management for endpoints and servers so known flaws are closed.

  3. Use exploit protection

    Use exploit protection tools and control flow integrity checks that can detect and block exploitation behavior.

  4. Isolate and plan

    Sandboxing, virtualization and microsegmentation can limit what an exploit achieves, and a threat intelligence program helps show which exploits target your organization.

Questions

What is exploitation for privilege escalation?

It is when an attacker uses a flaw in the operating system or in software running with higher permissions to break out of a limited process and reach SYSTEM or root level. MITRE ATT&CK tracks it as T1068.

What is BYOVD?

Bring Your Own Vulnerable Driver is a variant where an attacker brings a signed vulnerable driver onto a compromised machine and exploits it to run code in kernel mode.

How can defenders detect privilege escalation exploits?

Look for signs that a vulnerable kernel driver or operating system component was exploited, followed by unusual process or token behavior. MITRE also describes detections for setuid programs and kernel modules on Linux and for container breakout.

How do you defend against exploitation for privilege escalation?

Run regular patch management, consider blocking known vulnerable drivers, and use exploit protection tools. Sandboxing, virtualization and microsegmentation can also limit what an exploit achieves.

In our research

  1. Reynolds Ransomware: BYOVD Evasion & NSecKrnl Abuse February 2026
  2. Lindnor Backdoor and EDR Killers: A Hunt Plan in Seven Steps November 2026
  3. GPT-6 Cyber: How OpenAI’s Kernel Pipeline Works and What Defenders Should Change November 2026
  4. Kyverno 1.19.2: Seven Critical Flaws Compared by Who Can Exploit Them November 2026
  5. Three Ways Beta9 Lets a Tenant Escape Its Sandbox November 2026
  6. Akira ransomware advisory AA24-109A: stages and tools October 2026

Sources

  1. MITRE ATT&CK T1068: Exploitation for Privilege Escalation MITRE
  2. MITRE ATT&CK Privilege Escalation (TA0004) MITRE
  3. GOLD SHERWOOD threat profile Sophos

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

APT27 threat group profile

Attributed by MITRE ATT&CK and by the US Department of Justice (5 March 2025) to a Chinese group, also called Threat Group-3390 and Emissary Panda, that targets governments and companies. The Justice Department charged two men it calls APT27 actors, alleging profit-driven hacking from 2013 to 2024.

Read more

Threat group

APT28

The US, UK, EU and other governments attribute APT28 to Russia's military intelligence service, the GRU, specifically its 85th Main Special Service Center (military unit 26165). MITRE says the group has been active since at least 2004, and government advisories describe espionage against governments, militaries, political parties, media and logistics firms.

Read more