Definition (brief)
Privilege escalation is when an actor or process gains higher access than originally granted. As an analyst, I monitor for these to prevent lateral movement and data exfiltration.
Vertical vs Horizontal
- Vertical (privilege elevation): low-privilege user or process becomes admin/root. Example: exploiting a setuid binary on Linux to get root.
- Horizontal (privilege lateral): user accesses another user’s account or resources at same level. Example: accessing another employee’s files after stealing credentials.
Common techniques
- Windows: abusing weak service permissions, DLL search-order hijacking, unquoted service paths, exploiting vulnerable drivers, Kerberoasting for service account creds.
- Linux: exploiting setuid binaries, writable cron jobs, SUID/SGID misconfigurations, PATH/LD_PRELOAD abuse, kernel exploits (e.g., Dirty COW historically).
Indicative logs/behaviors
- Unexpected process spawning from low-privilege accounts to privileged binaries
- Service installs/privilege change events (Windows Event IDs: 4698/4697, 4670; Linux: sudo/sshd logs, auth.log with unusual sudo success)
- Creation of new admin users, suspicious driver/service loads, unusual use of credential dumping tools, privilege-related audit failures/successes
Three controls (preventive/detective)
- Least-privilege + hardening: remove local admin rights, restrict write access to service paths and binaries, enforce sudo policies.
- Patch & inventory: timely OS/driver/third-party patching and regular attack-surface scans for setuid/writable files.
- Detection & logging: forward Windows Security and Linux auditd logs to SIEM, alert on new admin creation, service installs, abnormal use of privileged commands and credential-dumping signatures.
I would prioritize tuning SIEM alerts to reduce noise and verify alerts with endpoint process trees and file integrity checks.
