Privilege escalation

Privilege escalation is tactic TA0004 in MITRE ATT&CK and corresponds to the "E" in Microsoft's STRIDE threat model (Elevation of Privilege). Defenders distinguish two directions. Vertical escalation raises an account from lower to higher rights on the same system - a standard user becoming a local administrator, or a service account becoming SYSTEM or root. Horizontal escalation keeps the same privilege level but reaches another user's resources; in isolation this is really an access-control failure, and it overlaps with the OWASP category of broken access control. The value of escalation to an attacker is that low-privilege footholds are easy to obtain but limited; higher rights allow disabling security tooling, clearing logs, installing persistence and reaching data across the host.

The underlying weaknesses fall into recognisable classes rather than single tricks. Misconfiguration is the largest: over-permissive file and service permissions, writable directories in the executable search path, unquoted service paths, and scheduled tasks running as a privileged account but modifiable by others. Software vulnerabilities in privileged code - kernel drivers, setuid binaries on Unix, and Windows components - are a second class; local privilege-escalation bugs are a standing category in vendor patch cycles. Excessive standing privilege is a third: users who are permanent local administrators, over-broad role assignments, and unconstrained delegation or shadow-admin relationships in Active Directory that let a modest account reach domain-level control. On cloud platforms the same idea appears as IAM privilege escalation, where a permissive policy lets an identity grant itself more rights (for example by editing a role it can modify).

Because escalation almost always exploits configuration or excess rights, the strongest defences are structural rather than reactive. The principle of least privilege and role-based access control keep standing rights minimal; just-in-time and just-enough administration remove permanent elevation; on Windows, User Account Control and removing users from the local Administrators group raise the bar, while Linux uses sudo policies, capabilities and mandatory access control (SELinux, AppArmor). Prompt patching closes the vulnerability class, application allow-listing constrains what a foothold can run, and periodic access reviews and tools that audit effective permissions catch the misconfiguration class before an attacker does. NIST SP 800-53 control AC-6 (Least Privilege) is the canonical governance hook.

A common misconception is that escalation is a single exploit; more often it is the productive use of legitimate but excessive rights, which is why it evades signature detection and must be caught behaviourally - a normally unprivileged account suddenly acting as administrator, or a service spawning an interactive shell. It is distinct from its neighbours: privilege escalation increases rights on one host, whereas lateral movement uses rights to reach other hosts, and the two are typically chained - escalate on one machine to harvest the credentials that enable movement to the next.