SIGNAL//DESK
AI securitysrc: MITRE ATLAS

Privilege Escalation

Privilege escalation is like a guest at a hotel who finds a way to get a master key card so they can open doors they aren't supposed to, allowing them to go anywhere in the building.

Privilege escalation involves exploiting system vulnerabilities, misconfigurations, or software flaws to transition from a low-privileged account to a higher-privileged account, such as root or administrator, to bypass security controls and achieve unauthorized objectives.

The adversary is trying to gain higher-level permissions. Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. Examples of elevated access include: - SYSTEM/root level - local administrator - user account with admin-like access - user accounts with access to specific system or perform specific function These techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.

evolution

  1. 1974 · history
    Concept Formalization

    The term privilege escalation was formally identified in early computer security research as a core threat vector for unauthorized system access.

  2. 2017 · history
    MITRE ATT&CK Framework

    MITRE officially codified Privilege Escalation (T1068) as a standard tactical category for tracking adversary behavior in enterprise environments.

  3. 2023 · history
    LLM Prompt Injection Escalation

    Security researchers demonstrated that prompt injection can be used to bypass AI system guardrails, effectively escalating user privileges to execute unauthorized model functions.

  4. 2024 · history
    AI Agentic Escalation

    The rise of autonomous AI agents led to new research on 'indirect privilege escalation,' where agents are manipulated to perform actions exceeding their intended scope.

seen in events

← all terms