{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/privilege-escalation","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/privilege-escalation/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/privilege-escalation/"},"term":{"en":"Privilege escalation","da":"Rettighedseskalering (privilege escalation)"},"aka":{"en":["elevation of privilege"],"da":["privilege escalation","rettighedsforøgelse"]},"domain":["security"],"cluster":"fundamentals","layer":"host","status":"current","summary":{"en":"An attacker who has a small foothold gaining more rights than they were given, up to full control of the system.","da":"En angriber med et lille fodfæste, der skaffer sig flere rettigheder end tildelt - helt op til fuld kontrol over systemet."},"body":{"formal":{"en":"The step in an attack where someone with limited rights on a system uses a flaw, a poor setting or a stolen credential to gain higher rights, typically those of a privileged account or the operating system itself.","da":"Det trin i et angreb, hvor en person med begrænsede rettigheder på et system udnytter en fejl, en dårlig indstilling eller en stjålen loginoplysning til at få højere rettigheder, typisk en privilegeret kontos eller selve styresystemets."},"plain":{"en":"Like a hotel guest whose card opens only one room, who finds a way to turn it into the manager's master key.","da":"Som en hotelgæst, hvis kort kun åbner ét værelse, og som finder en måde at gøre det til direktørens hovednøgle."},"inPractice":{"en":"After a phishing mail gives an attacker the login of an ordinary clerk at a Danish ministry, he finds a program on her laptop that runs with admin rights and can be tricked into running his code - and now controls the whole machine.","da":"Efter at en phishingmail har givet en angriber adgang til en almindelig medarbejders konto i et ministerium, finder han et program på hendes bærbare, der kører med administratorrettigheder og kan narres til at køre hans kode - og nu styrer han hele maskinen."},"whyItMatters":{"en":"An ordinary account can do limited harm; once the attacker holds the highest rights they can turn off protection, hide their tracks and reach everything.","da":"En almindelig konto kan kun gøre begrænset skade; når angriberen har de højeste rettigheder, kan han slå beskyttelsen fra, skjule sine spor og nå alt."}},"deepDive":{"en":"Privilege escalation is tactic TA0004 in MITRE ATT&CK and corresponds to the \"E\" in Microsoft's STRIDE threat model (Elevation of Privilege). Defenders distinguish two directions. Vertical escalation raises an account from lower to higher rights on the same system - a standard user becoming a local administrator, or a service account becoming SYSTEM or root. Horizontal escalation keeps the same privilege level but reaches another user's resources; in isolation this is really an access-control failure, and it overlaps with the OWASP category of broken access control. The value of escalation to an attacker is that low-privilege footholds are easy to obtain but limited; higher rights allow disabling security tooling, clearing logs, installing persistence and reaching data across the host.\n\nThe underlying weaknesses fall into recognisable classes rather than single tricks. Misconfiguration is the largest: over-permissive file and service permissions, writable directories in the executable search path, unquoted service paths, and scheduled tasks running as a privileged account but modifiable by others. Software vulnerabilities in privileged code - kernel drivers, setuid binaries on Unix, and Windows components - are a second class; local privilege-escalation bugs are a standing category in vendor patch cycles. Excessive standing privilege is a third: users who are permanent local administrators, over-broad role assignments, and unconstrained delegation or shadow-admin relationships in Active Directory that let a modest account reach domain-level control. On cloud platforms the same idea appears as IAM privilege escalation, where a permissive policy lets an identity grant itself more rights (for example by editing a role it can modify).\n\nBecause escalation almost always exploits configuration or excess rights, the strongest defences are structural rather than reactive. The principle of least privilege and role-based access control keep standing rights minimal; just-in-time and just-enough administration remove permanent elevation; on Windows, User Account Control and removing users from the local Administrators group raise the bar, while Linux uses sudo policies, capabilities and mandatory access control (SELinux, AppArmor). Prompt patching closes the vulnerability class, application allow-listing constrains what a foothold can run, and periodic access reviews and tools that audit effective permissions catch the misconfiguration class before an attacker does. NIST SP 800-53 control AC-6 (Least Privilege) is the canonical governance hook.\n\nA common misconception is that escalation is a single exploit; more often it is the productive use of legitimate but excessive rights, which is why it evades signature detection and must be caught behaviourally - a normally unprivileged account suddenly acting as administrator, or a service spawning an interactive shell. It is distinct from its neighbours: privilege escalation increases rights on one host, whereas lateral movement uses rights to reach other hosts, and the two are typically chained - escalate on one machine to harvest the credentials that enable movement to the next.","da":"Rettighedseskalering er taktikken TA0004 i MITRE ATT&CK og svarer til \"E\" i Microsofts STRIDE-trusselsmodel (Elevation of Privilege). Forsvarere skelner mellem to retninger. Vertikal eskalering hæver en konto fra lavere til højere rettigheder på samme system - en almindelig bruger, der bliver lokal administrator, eller en servicekonto, der bliver SYSTEM eller root. Horisontal eskalering bevarer samme rettighedsniveau, men når en anden brugers ressourcer; isoleret set er det reelt en fejl i adgangskontrollen og overlapper med OWASP-kategorien broken access control. Værdien af eskalering for en angriber er, at fodfæster med få rettigheder er lette at få, men begrænsede; højere rettigheder tillader at slå sikkerhedsværktøjer fra, rydde logs, installere persistens og nå data på tværs af værten.\n\nDe underliggende svagheder falder i genkendelige klasser snarere end enkelte tricks. Fejlkonfiguration er den største: for brede fil- og tjenesterettigheder, skrivbare mapper i eksekverbares søgesti, uciterede tjenestestier og planlagte opgaver, der kører som en privilegeret konto, men kan ændres af andre. Softwaresårbarheder i privilegeret kode - kernedrivere, setuid-programmer på Unix og Windows-komponenter - er en anden klasse; lokale rettighedseskaleringsfejl er en fast kategori i leverandørers patchcyklusser. For mange stående rettigheder er en tredje: brugere, der permanent er lokale administratorer, for brede rolletildelinger og ubegrænset delegering eller shadow-admin-relationer i Active Directory, der lader en beskeden konto nå domænekontrol. På cloudplatforme optræder samme idé som IAM-rettighedseskalering, hvor en for tilladende politik lader en identitet give sig selv flere rettigheder (fx ved at redigere en rolle, den kan ændre).\n\nFordi eskalering næsten altid udnytter konfiguration eller for mange rettigheder, er de stærkeste forsvar strukturelle frem for reaktive. Princippet om least privilege og rollebaseret adgangskontrol holder stående rettigheder minimale; just-in-time- og just-enough-administration fjerner permanent forhøjelse; på Windows hæver User Account Control og fjernelse af brugere fra den lokale Administrators-gruppe barren, mens Linux bruger sudo-politikker, capabilities og mandatory access control (SELinux, AppArmor). Hurtig patching lukker sårbarhedsklassen, application allow-listing begrænser, hvad et fodfæste kan køre, og periodiske adgangsgennemgange og værktøjer, der auditerer effektive rettigheder, fanger fejlkonfigurationsklassen, før en angriber gør det. NIST SP 800-53-kontrollen AC-6 (Least Privilege) er det kanoniske governance-anker.\n\nEn udbredt misforståelse er, at eskalering er ét enkelt exploit; oftere er det den produktive brug af legitime, men for brede rettigheder, og derfor undgår det signaturdetektion og skal fanges adfærdsmæssigt - en normalt uprivilegeret konto, der pludselig optræder som administrator, eller en tjeneste, der starter en interaktiv shell. Det adskiller sig fra sine naboer: rettighedseskalering øger rettigheder på én vært, mens lateral bevægelse bruger rettigheder til at nå andre værter, og de to kædes typisk sammen - eskalér på én maskine for at høste de loginoplysninger, der muliggør bevægelse til den næste."},"edges":[{"type":"requires","to":"cs/permission","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/privileged-account","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/threat","confidence":"high","strength":"normal"},{"type":"exploits","to":"security/vulnerability","why":{"en":"Gaining higher rights depends on a flaw or a poor setting that lets a low-rights user act as a higher one.","da":"At få højere rettigheder afhænger af en fejl eller en dårlig indstilling, der lader en bruger med få rettigheder optræde som en med flere."},"confidence":"high","strength":"primary"},{"type":"causes","to":"security/lateral-movement","why":{"en":"Admin rights on one machine often give up stored logins that open the way to the next machines.","da":"Administratorrettigheder på én maskine giver ofte adgang til gemte loginoplysninger, der åbner vejen til de næste maskiner."},"confidence":"medium","strength":"normal"}],"depth":4,"sources":[{"title":"MITRE ATT&CK - Privilege Escalation (TA0004)","url":"https://attack.mitre.org/tactics/TA0004/","tier":"reference","publisher":"MITRE"},{"title":"Microsoft - STRIDE threat model (Elevation of privilege)","tier":"official-doc","publisher":"Microsoft"}],"draft":true}