Privilege escalation
noun · MITRE ATT&CK TA0004
Gaining higher permissions than an account was given, such as moving from a standard user to local administrator, domain admin or cloud global admin.
Attackers rarely start with the access they need. A phished user can read their own mailbox but cannot disable security tools, dump credentials or deploy ransomware across the network. Privilege escalation is how they close that gap, and MITRE ATT&CK treats it as its own tactic (TA0004).
Common routes include exploiting a vulnerability in the operating system or a driver (T1068), abusing misconfigured services and scheduled tasks, bypassing User Account Control (T1548), stealing tokens from privileged processes (T1134) and, most often, simply finding credentials for a more privileged account. In the cloud, the equivalent is assigning a powerful role, such as Global Administrator, to an account the attacker controls.
Example
After phishing a help desk technician, an attacker finds a script on a file share containing a service account password. That account is a member of the local Administrators group on every server, which gives the attacker the foothold they need to dump credentials and eventually reach a domain administrator.
Why it matters for a SOC analyst
Changes to privileged groups and roles are some of the highest-value events you can monitor. On Windows, watch for members added to security groups (events 4728, 4732 and 4756) and for special privileges assigned at logon (4672) to unexpected accounts; in Entra ID, watch for role assignments in the audit logs. Least privilege makes every one of these steps harder for the attacker.
Related terms
- Least privilege
Giving every user, service and application only the access it needs to do its job, and only for as long as it needs it.
- Lateral movement
The techniques attackers use to move from the first compromised system to other systems and accounts inside a network.
- Living off the land
Attacking with tools already present on the victim's systems, such as PowerShell or WMI, so the activity blends in with normal administration.
- Golden ticket
A forged Kerberos ticket-granting ticket, made with the krbtgt account's key, that lets an attacker impersonate any user in the domain.
- Ransomware
Malware that encrypts an organization's data and demands payment for the key, often after stealing the data to threaten its release.
- MITRE ATT&CK
A free, public knowledge base of adversary tactics and techniques based on real-world observations, used as a common language for attack and defense.