Privilege Escalation
Privilege Escalation is a technique where an attacker gains higher-level permissions than their current account holds. They might exploit a vulnerability to become an administrator, trick a privileged user into delegating access, or access abandoned privileged credentials.
# WHAT TEAMS RUN INTO
- —
Some privilege escalations are invisible. An attacker can escalate privilege using a kernel exploit or by accessing a privileged credential that was never deprovisioned. The escalation leaves no audit trail.
- —
Privilege escalation is hard to detect because elevated access is legitimate for some users. Distinguishing between legitimate privileged access and escalated access by an attacker requires understanding why the privilege is being used.
- —
Standing privilege accelerates escalation damage. If users and services run with excess privilege by default, an attacker who compromises them gets that privilege immediately. Least privilege makes escalation attacks less damaging.
# WHY IT MATTERS
Privilege escalation is where attacks become catastrophic. An attacker in a normal user account has limited damage potential. An attacker with admin or root access can do anything. Organizations that enforce least privilege limit the impact of escalation. Organizations that hand out privilege generously guarantee that compromise will be maximally damaging.