MITRE ATT&CKtactic

TA0004 Privilege Escalation

Published 2018-10-17 Modified 2025-04-25 Official page ↗
Domain
enterprise
Version
1.0
Created
2018-10-17

Description

The adversary is trying to gain higher-level permissions. Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. Examples of elevated access include: • SYSTEM/root level • local administrator • user account with admin-like access • user accounts with access to specific system or perform specific function These techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.

Related

Referenced by MITRE ATT&CK · tactic (96)

  • T1546.018 Python Startup Hooks sub-technique
  • T1546.017 Udev Rules sub-technique
  • T1098.007 Additional Local or Domain Groups sub-technique
  • T1548.006 TCC Manipulation sub-technique
  • T1543.005 Container Service sub-technique
  • T1098.006 Additional Container Cluster Roles sub-technique
  • T1548.005 Temporary Elevated Cloud Access sub-technique
  • T1546.016 Installer Packages sub-technique
  • T1098.005 Device Registration sub-technique
  • T1055.015 ListPlanting sub-technique
  • T1547.015 Login Items sub-technique
  • T1611 Escape to Host technique
  • T1053.007 Container Orchestration Job sub-technique
  • T1484.001 Group Policy Modification sub-technique
  • T1484.002 Trust Modification sub-technique
  • T1547.014 Active Setup sub-technique
  • T1053.006 Systemd Timers sub-technique
  • T1547.012 Print Processors sub-technique
  • T1098.004 SSH Authorized Keys sub-technique
  • T1546.015 Component Object Model Hijacking sub-technique
  • T1078.001 Default Accounts sub-technique
  • T1078.002 Domain Accounts sub-technique
  • T1078.003 Local Accounts sub-technique
  • T1078.004 Cloud Accounts sub-technique
  • T1134.001 Token Impersonation/Theft sub-technique
  • T1134.002 Create Process with Token sub-technique
  • T1134.003 Make and Impersonate Token sub-technique
  • T1134.004 Parent PID Spoofing sub-technique
  • T1134.005 SID-History Injection sub-technique
  • T1548 Abuse Elevation Control Mechanism technique
Show all 96 ›