CAPEC-234 Hijacking a privileged process

An adversary gains control of a process that is assigned elevated privileges in order to execute arbitrary code with those privileges. Some processes are assigned elevated privileges on an operating system, usually through association with a particular user, group, or role. If an attacker can hijack this process, they will be able to assume its level of privilege in order to execute their own code.

1. [Explore] [Find process with elevated priveleges] The adversary probes for processes running with elevated privileges. 2. [Experiment] [Find vulnerability in running process] The adversary looks for a vulnerability in the running process that would allow for arbitrary code execution with the privilege of the running process. 3. [Exploit] [Execute arbitrary code] The adversary exploits the vulnerability that they have found and hijacks the running process.

• The targeted process or operating system must contain a bug that allows attackers to hijack the targeted process.