Privilege Escalation: techniques and detection

Privilege Escalation refers to techniques used by attackers to gain higher access rights than those initially obtained on a compromised system. This concept covers two distinct vectors. Vertical escalation means moving from a low-privileged account to a higher one, such as SYSTEM or root. Horizontal escalation means accessing resources belonging to another user at the same privilege level. Technically, escalation exploits misconfigurations, unpatched vulnerabilities, or design flaws in operating systems and applications. Common attack surfaces include weak service permissions, unquoted service paths on Windows, misconfigured sudo rules on Linux, vulnerable kernel versions, and insecure token handling. In the MITRE ATT&CK framework, Privilege Escalation is catalogued under Tactic TA0004. It groups over 60 specific techniques. Attackers rarely operate at low privilege for long. Escalating rights is a critical step before lateral movement, credential dumping, or persistence. Understanding the exact mechanisms behind escalation is essential for both Red Team operators designing realistic attack chains and Blue Team analysts prioritising detection rules.

Detecting Privilege Escalation requires correlating multiple log sources simultaneously. On Windows systems, Event ID 4672 signals the assignment of special privileges to a new logon session. Event ID 4673 records privileged service calls. Event ID 4674 captures attempts to use privileged operations. UAC bypass attempts often generate Event ID 4688 with unusual parent-child process relationships, such as fodhelper.exe spawning cmd.exe. Token impersonation attacks leave traces in Security log entries related to SeImpersonatePrivilege or SeDebugPrivilege assignments. On Linux, monitor /var/log/auth.log for unexpected sudo executions and SUID binary invocations outside of standard paths. SIEM rules should flag any process running as root that was spawned by a non-privileged parent. EDR solutions like CrowdStrike Falcon or Microsoft Defender for Endpoint correlate process trees and detect known escalation patterns in near real-time. Threat hunters should also look for unusual scheduled task creation, new service registration under SYSTEM context, and DLL hijacking indicators such as DLLs loaded from user-writable directories. Baselining normal privilege usage per user role significantly reduces false positives.

Red Team operators rely on established tooling and manual enumeration to identify and exploit Privilege Escalation paths. On Windows, WinPEAS and PowerUp automate the discovery of weak service permissions, AlwaysInstallElevated registry keys, unquoted service paths, and stored credentials. Token impersonation using tools like Incognito or the built-in Meterpreter module allows lateral movement under a more privileged token without needing a password. PrintSpoofer and RoguePotato target SeImpersonatePrivilege on server environments. On Linux, LinPEAS enumerates SUID binaries, writable cron jobs, and kernel exploit candidates. GTFOBins documents how legitimate binaries can be abused to escalate rights when misconfigured. Hardening against these techniques requires enforcing least-privilege principles strictly. Service accounts should never run as SYSTEM without justification. UAC should be set to maximum enforcement. Kernel patching cadence must be fast. On Linux, removing unnecessary SUID bits, auditing sudo rules with 'sudo -l' regularly, and enabling AppArmor or SELinux profiles significantly reduces the attack surface. Credential Guard on Windows prevents token theft from LSASS memory. Regular internal pentest exercises should include automated escalation path checks as a core deliverable.