Attack Technique
Privilege Escalation
Privilege escalation is a common method today’s attackers use to create catastrophic data breaches. Here’s what you need to know about this attack technique.
Definition
What is privilege escalation?
Privilege escalation is a technique attackers use to gain unauthorized access to privileged accounts — ones that can be used to deploy malware and conduct other malicious activities. It typically starts when an attacker gains access to the corporate network by taking over a standard user account. Once inside, they work their way up to admin, superuser, and other high-level hosts and accounts.
Types of Privilege Escalation
Vertical Privilege Escalation (Privilege Elevation)
Vertical Privilege Escalation or Privilege Elevation occurs when an attacker moves from a lower privilege level to a higher one. For example, a regular user gaining administrative rights. This technique grants access to protected system functions and sensitive data, increasing the potential damage.
Horizontal Privilege Escalation
Horizontal Privilege Escalation involves accessing peer-level privileges or resources of another user with similar access levels. This technique allows attackers to access or manipulate another user's data or services without authorization.
How it works
How does privilege escalation work?
Vertical privilege escalation
This occurs when an attacker with limited access rights, such as a regular user, exploits vulnerabilities to gain higher-level privileges, such as administrative or root access. This is the most common form of privilege escalation and can lead to significant security risks.
Horizontal privilege escalation
In this case, an attacker moves laterally within a system, gaining access to resources or accounts of other users who have similar access rights. While horizontal escalation doesn't involve escalating to higher privileges, it allows attackers to exploit other accounts or data.
How do attackers proceed to escalate privileges?
1. Initial Access Acquisition
Attackers begin by gaining entry into a system with basic user privileges. They achieve this through methods such as phishing, where deceptive communications trick users into revealing credentials; exploiting vulnerabilities in software or systems that have not been properly secured; or using default credentials that were never changed after installation. The primary goal at this stage is to establish a foothold within the system, creating a platform from which they can launch further attacks.
2. System Enumeration and Reconnaissance
Once inside the system, attackers engage in system enumeration and reconnaissance to gather detailed information about the environment. They collect data on the system architecture, operating system versions, installed applications, running services, and existing user accounts. This information gathering is facilitated by tools such as command-line utilities, system scripts, and network scanning tools, which help map out the system's structure and identify potential targets for exploitation.
3. Identifying Vulnerabilities
With comprehensive knowledge of the system, attackers proceed to identify vulnerabilities that can be exploited to escalate their privileges. They look for software vulnerabilities, such as unpatched bugs or flaws that have known exploits. Configuration weaknesses are also sought out, including misconfigured services, insecure file permissions that allow unauthorized access, or default settings that have not been properly secured. Additionally, they assess credential issues like weak passwords that are easy to guess or crack, reused credentials across multiple systems, or exposed authentication tokens that can be intercepted.
4. Exploitation Techniques
To take advantage of the identified vulnerabilities, attackers employ various exploitation techniques. When exploiting software vulnerabilities, they may perform buffer overflows by injecting code into a program through overrunning a buffer's boundary, or conduct code injection by inserting malicious code into trusted applications. Abusing misconfigurations is another tactic; attackers might exploit insecure file permissions to access or modify files due to improper permission settings, or leverage SUID/SGID abuse on Unix/Linux systems by exploiting files that execute with higher privileges.
Credential theft is a critical method used to gain unauthorized access. Attackers might engage in password hash dumping, extracting password hashes from system memory or files to crack them offline. Keylogging is another technique, where they record keystrokes to capture passwords and other sensitive information. To bypass security controls, attackers may manipulate tokens, using stolen tokens to impersonate higher-privileged users. On Windows systems, they might perform DLL hijacking by replacing legitimate Dynamic Link Library (DLL) files with malicious ones to execute code with elevated privileges. Exploiting weaknesses in User Account Control (UAC) allows them to perform administrative tasks without prompting the user, effectively bypassing a key security feature.
5. Gaining Elevated Privileges
Armed with these techniques, attackers aim to gain elevated privileges within the system. They execute exploits by running specialized scripts or tools designed to take advantage of the identified vulnerabilities. Deploying privilege escalation payloads involves introducing malware specifically crafted to escalate privileges upon execution. Service exploitation is another avenue, where attackers target services that are running with higher privileges, manipulating them to execute arbitrary code that grants them increased access rights.
6. Post-Exploitation Activities
After successfully escalating their privileges, attackers engage in post-exploitation activities to solidify their control and prepare for further operations. To maintain access, they may create backdoors by installing persistent methods that allow them to re-enter the system even after reboots or security updates. Adding new user accounts with administrative privileges ensures they have ongoing access without relying on the initial exploit.
Covering their tracks is essential to avoid detection. Attackers manipulate logs by deleting or altering event records to hide evidence of their activities. They may also modify file timestamps to prevent forensic analysts from identifying anomalies during investigations. With elevated privileges, attackers can perform lateral movement within the network. Network propagation involves using their access to infiltrate other systems connected to the network, expanding their reach and potential impact. They leverage obtained credentials to infiltrate additional resources, a process known as credential reuse, which allows them to compromise more accounts and systems without triggering immediate suspicion.
Why attackers use it
Why do attackers use privilege escalation?
Attackers use privilege escalation techniques to gain unauthorized access to higher levels of permissions within a system or network. By elevating their privileges, attackers can perform actions that are normally restricted, such as accessing sensitive data, installing malware, altering system configurations, or taking complete control of a system. Understanding why attackers use these techniques is crucial for implementing effective security measures.
Below are the primary reasons and methods behind the use of privilege escalation by attackers:
Access to Sensitive Data
- Confidential Information: Elevated privileges allow attackers to access sensitive files, databases, and communications that are restricted to regular users.
- Data Exfiltration: Attackers can steal valuable data such as personal identities, financial records, or proprietary business information.
System Control and Persistence
- Maintaining Access: With higher privileges, attackers can create backdoors, new user accounts, or modify authentication mechanisms to retain long-term access.
- Disabling Security Measures: They can turn off antivirus software, firewalls, or intrusion detection systems to avoid detection.
Lateral Movement within Networks
- Expanding Reach: Privilege escalation enables attackers to move across different systems and network segments, increasing the scope of their attack.
- Compromising Additional Systems: Access to administrative credentials allows attackers to infiltrate other devices and servers within the network.
Execution of Advanced Attacks
- Installing Malware or Ransomware: Higher privileges are often required to install or execute malicious software that can encrypt data or disrupt operations.
- System Manipulation: Attackers can alter system configurations, schedules, or services to benefit their objectives.
Bypassing Security Restrictions
- Overriding Permissions: Elevated privileges allow attackers to bypass file system permissions and access controls.
- Accessing Restricted Functions: They can perform actions that are normally limited to administrators, such as modifying audit logs.
Credential Harvesting
- Collecting Passwords and Tokens: Attackers can extract credentials from memory, configuration files, or keychains.
- Kerberos Ticket Extraction: They may use techniques like Pass-the-Hash or Kerberoasting to obtain authentication tokens.
Disruption and Sabotage
- Denial of Service (DoS): Attackers can stop critical services or overload system resources.
- Data Manipulation or Destruction: They can alter or delete data, causing operational issues or loss of trust.
Financial Gain
- Monetary Theft: Access to financial systems enables attackers to manipulate transactions or divert funds.
- Ransom Demands: They can encrypt data and demand payment for decryption keys.
Covering Tracks
- Log Tampering: With higher privileges, attackers can erase or alter logs to hide their activities.
- Disabling Monitoring Tools: They can shut down or interfere with security monitoring solutions.
Platform Detections
How to detect activities related to privilege escalation
Most organizations use a combination of security measures to prevent privilege escalation attacks. Zero trust, identity and access management (IAM) and privileged access management (PAM) are all common examples.
But there’s a problem with these approaches: They all rely on a single point of entry. What’s more, most organizations have 3x more privileged accounts than employees, making it impossible to manage them all. And once access is granted, it can easily be manipulated.
To stay ahead of privilege escalation, continuous visibility is key. Constantly monitoring and analyzing account activity allows you to identify abuse in real time. And the only way to do it accurately is with AI.
This is where extended threat detection and response comes in. Vectra AI uses dozens of AI-driven detections to identify abnormal privilege-related activities across network, identity, and public cloud. These detections do not focus on anomalies, but rather actual attacker behaviors. From unusual requests on AWS and Entra ID to suspicious service requests, each one is automatically correlated, analyzed, validated, and triaged to show defenders when attackers are attempting to use privilege escalation.
