Threat Hunting in the Cloud

APPENDIX BPrivilege Escalation

Privilege escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. Examples of elevated access include:

• System/root level
• Local administrator
• User account with admin-like access
• User accounts with access to specific systems or the ability to perform specific functions

These techniques often overlap with persistence techniques, as OS features that let an adversary persist can execute in an elevated context.

ID	NAME	DESCRIPTION
T1134	Access Token Manipulation	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Token Impersonation/Theft	Adversaries may duplicate then impersonate another user's token to escalate privileges and bypass access controls. An adversary can create a new access token that ...