Privilege escalation is an attack technique that gives threat actors unauthorized access to higher-level permissions within a network or system. Granting malicious insiders higher permissions enables them to launch attacks, disable security policies, and cover their tracks more successfully.
Most privilege escalation attacks rely on exploiting a vulnerability that allows a threat actor to compromise multiple assets or applications on a network. This behavior is closely related to lateral movement, which describes the process of gaining deeper, broader access to networks while looking for high-value data to modify, exfiltrate, or destroy.
Most regular users are unaware of their permissions and privilege limitations — until they come across an asset or file they can’t access. A legitimate user may request access authorization for such a file, but a malicious one will try to gain access in secret.
If threat actors are successful in their attempts to escalate privileges, they gain much more control over the system they are trying to exploit. This makes it much easier for them to launch highly sophisticated cyberattacks and make them difficult or impossible to defend against.
There are two types of privilege escalation:
The main difference between these two types of privilege escalation is the attacker’s ultimate objective. Vertical escalation may indicate preparation for a complex cyberattack, while horizontal escalation may grant access to a specific file or asset the threat actor is looking for.
There are several things security lakers can do to prevent threat actors from carrying out privilege escalation attacks:
Prevention-based security controls are not enough to fully mitigate the risk of privilege escalation. They should be complemented by a robust set of detection-based technologies and solutions.
Threat actors may use multiple methods to escalate privileges and gain a firmer foothold on their target’s networks. Some of the most common methods they use involve leveraging misconfigurations, stealing user credentials, exploiting vulnerabilities, conducting social engineering attacks, or installing malware.
1. Exploiting misconfigurations
Misconfigured infrastructure can lead to privilege escalation attacks. When system administrators accidentally leave configuration errors in the environment, it provides threat actors with the opportunity to compromise privileged user accounts and gain more control.
2. Credential-based attacks
Attackers may take advantage of user accounts with weak passwords or steal valid credentials using keylogging or pass-the-hash attacks. They may target users with high-level permissions, take over their accounts, and then grant themselves the privileges they need to carry out an attack.
3. Exploiting known vulnerabilities
If your organization doesn’t have a robust patch management policy, threat actors may be able to leverage vulnerabilities in unpatched software. These are often widely known because software vendors release changelogs with each new update — and those changelogs contain all the information hackers need to know.
4. Social engineering
Attackers may trick employees, partners, or other human users into giving up important information about privileged user accounts. Even small bits of seemingly unimportant information can help hackers conduct these types of attacks.
5. Malware
Malware attacks can result in privilege escalation when deployed on targeted systems. An attacker may gain initial access to an asset and then deploy a malicious payload that escalates their ability to control it, resulting in a privilege escalation attack.
To adequately protect against insider risk, security teams need to implement technical capabilities supported by on-demand specialist talent. SIEM platforms must be enhanced with behavioral analytics and ample access to low-cost storage — without compromising observability.
This requires a multi-layered threat defense that adheres to the SOC Visibility Triad, providing unlimited visibility and control to incident response teams. Supporting those teams with reputable managed detection and response capabilities blocks attackers from leveraging vulnerabilities and escalating permissions to execute attacks.
