Privilege Escalation

A privilege escalation attack occurs when an attacker gains access to a regular user account, bypasses the proper authorization channel, and successfully grants themselves elevated access permissions.

Obtaining elevated privileges is the "holy grail" of attackers. If an attacker successfully obtains a privileged account, they can get access to various parts of the organization, review, copy, alter or altogether delete important data, configuration files or processes.

In case the organization identifies it has been compromised, it is vital to determine what permissions the attacker has managed to gain and what processes and resources may have been impacted and how.

escalation attacks are: that are considered privileged such as domain admin and

• Vertical Privilege Escalation

administrators, adding

(also known as privilege elevation) is multi-factor authentication when an attacker uses an account they (MFA) to reduce the risk of already have access to (or have gained such accounts being used in a unauthorized use of by other means) for running applications or services at higher privilege escalation attack.

permission levels. This happens when the applications developers have made However, it is important to remember, users incorrect assumptions about the use cases may aggregate permissions throughout for privileged functions, or if the their employment term, and since they are application allows command injection or exploits to be used. Phishing attacks considered "regular" users the added access that lure victims into entering sign-on controls may not be applied, and thus these credentials are commonly used steppingaggregated permission accounts stones to vertical privilege attacks.

may be used by an attacker.

Privilege escalation takes advantage of human, system and process vulnerabilities. To mitigate these risks, we should invest in implementing various controls that range from security awareness training to phishing simulations.

In mitigating the human risk, it's necessary to include additional access controls such as two-factor authentication (2FA), ongoing patch and vulnerabilities management, and intrusion detection and response such as IDS, IPS, and SIEMs.

• Horizontal Privilege Escalation, (or lateral movement within a system) is when an attacker uses an account they have access to as a way to discover, fingerprint, and gain access to other resources. For example, a user of applications and data on one server might be able to jump to another server and access data or resources on it. These attacks require the elevation of privileges associated with the accounts) being abused by the attacker, and usually require a greater degree of technical sophistication to pull off.