Privilege Escalation

Privilege escalation is the process by which an attacker increases their level of access on a system or network beyond what they were originally granted. A typical intrusion begins with limited privileges, perhaps a standard user account obtained through phishing. That account alone can do little of consequence, so the attacker seeks to escalate to administrative or system-level rights, which unlock the ability to access sensitive data, disable defences and take control.

There are two forms. Vertical privilege escalation moves from a lower privilege level to a higher one, for example from a standard user to an administrator or from an administrator to system or domain-level control. Horizontal privilege escalation stays at the same level but accesses the resources of another user, for example one customer reaching another customer’s account. Vertical escalation increases power; horizontal escalation increases reach. Both are serious, and real attacks often use them in combination.

The methods are varied. Attackers exploit vulnerabilities in operating systems or applications that allow a low-privilege process to gain higher rights. They abuse misconfigurations, such as excessive permissions, weak service-account settings or writable files that privileged processes trust. They harvest and reuse credentials, using techniques like kerberoasting and pass-the-hash to obtain the secrets of more privileged accounts. In web applications, flaws such as broken access control enable escalation within the application itself.

Privilege escalation is a pivotal stage in the lifecycle of an attack, sitting between initial access and the attacker’s objective. It is what converts a minor, contained compromise into a serious one: without escalation, a foothold is limited; with it, the attacker can often reach anything. For this reason it appears as a distinct tactic in the MITRE ATT&CK framework and is a primary focus of both attackers and defenders.

Defending against privilege escalation rests on the principle of least privilege, granting every account and process only the rights it genuinely needs, so there is less to escalate to and less damage possible if escalation succeeds. Prompt patching closes the vulnerabilities that enable technical escalation, strong credential hygiene limits credential-based routes, and monitoring for unusual privilege use helps catch escalation in progress. Careful configuration and regular review of permissions remove the misconfigurations attackers rely on.

Escalation is the hinge on which most intrusions turn, which is why the principle of least privilege is such a powerful defence. If every account and process holds only the rights it genuinely needs, there is less to escalate to and less damage possible when escalation does occur. Combined with prompt patching, strong credential hygiene and monitoring for unusual privilege use, least privilege removes many of the footholds that escalation depends on.

During penetration tests, Precursor maps privilege-escalation paths, showing the exact chain from a limited foothold to administrative control, so organisations can close the specific misconfigurations and weak credentials that enable it.