What is privilege escalation?¶

Privilege escalation is the process of obtaining greater access or authority than an account, process or user originally had.

Avoid the dangerous assumption¶

The dangerous assumption is that any administrator-level activity proves an administrator account was knowingly used.

It may not.

Privilege escalation may involve:

• exploiting a vulnerability
• stealing administrator credentials
• abusing excessive permissions
• misusing service accounts
• changing group membership
• bypassing access controls
• impersonating another process
• using delegated cloud roles
• abusing misconfiguration.

Investigators should establish:

• the starting privilege level
• the higher privilege obtained
• the method used
• the time of change
• the account or process involved
• the actions enabled afterwards.

Relevant evidence may include account and group changes, process tokens, administrative logs, service activity, security alerts, command history and cloud audit records.

Do not assume that access to an administrator account proves the account owner acted.

The account may have been compromised, shared or used by a service.

Likewise, the presence of a privilege-escalation exploit does not prove success.

The system may have blocked it or the account may already have had sufficient access.

Privilege escalation matters because later activity may appear legitimate when performed under a valid high-privilege identity.

Preserve the before-and-after permission state where possible.

Privilege escalation may occur in stages. An offender may first gain ordinary user access, then local administrator rights and finally wider directory or cloud control. Preserve each change separately because the method, evidence and person or process involved may differ at every stage.

Operational takeaway¶

Establish the original privilege, the method of increase and the actions enabled, while keeping the account owner separate from the person who used the elevated access.