Privilege Escalation 16 articles

Overview Abuse of Cloud Identity and Access Management (IAM) misconfigurations involves adversaries exploiting improperly configured permissions and roles within cloud environments to gain unauthorized access or escalate privileges. This technique…

Overview Abuse of Debug and SeImpersonate privileges is a technique used by adversaries to escalate privileges and gain unauthorized access within a target environment. These privileges allow an attacker to…

Overview Abuse of misconfigured service permissions is a technique where adversaries exploit overly permissive or improperly assigned access rights on system services to execute unauthorized actions. This technique can facilitate…

Overview Abuse of SUID (Set User ID) and SGID (Set Group ID) binaries is a technique where adversaries exploit executables with elevated privileges to execute arbitrary code with those privileges.…

Overview Bypassing User Account Control (UAC) is a technique used by adversaries to elevate privileges on Windows systems without triggering standard security prompts. It plays a critical role in the…

Overview Container escape for privilege escalation is a technique where an adversary breaks out of a containerized environment to gain elevated privileges on the host system. This technique is critical…

Overview Credential dumping for privilege escalation is a technique used by adversaries to extract account credentials from operating systems or software in order to gain higher-level access within a target…

Overview Credential Relay for Privilege Escalation is a technique where adversaries leverage intercepted or harvested authentication tokens or credentials to impersonate users with higher privileges. This method plays a critical…

Overview Driver-Based Privilege Escalation is a technique where adversaries exploit vulnerabilities or misconfigurations in device drivers to gain elevated system privileges. This method is typically employed after initial access to…

Overview Elevation via Scheduled Tasks is a technique where adversaries leverage legitimate task scheduling mechanisms to gain higher privileges or maintain persistence within a target environment. This method is commonly…

Overview Exploitation of local privilege escalation vulnerabilities is a technique used by adversaries to gain higher-level permissions on a compromised system. This technique plays a critical role in the attack…

Overview Exploitation of weak file and directory permissions is a technique where adversaries leverage improperly configured access controls to gain unauthorized access, escalate privileges, or maintain persistence within a system.…

Overview Kerberoasting is a post-compromise attack technique targeting service accounts in Active Directory environments. It enables adversaries to extract service ticket hashes for offline password cracking, facilitating privilege escalation and…

Overview Pass-the-Hash (PtH) is a credential theft technique used by adversaries to authenticate to remote systems by leveraging hashed password representations instead of plaintext credentials. It plays a critical role…

Overview Pass-the-Ticket (PtT) is a credential theft technique used by adversaries to escalate privileges and move laterally within a network by leveraging Kerberos ticket-granting tickets (TGTs) or service tickets. It…

Overview Token impersonation and token theft are techniques used by adversaries to assume the identity or privileges of legitimate users or processes within a system. These methods facilitate unauthorized access…