Tactic.View on attack.mitre.org
The adversary is trying to gain higher-level permissions.
Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. Examples of elevated access include:
* SYSTEM/root level
* local administrator
* user account with admin-like access
* user accounts with access to specific system or perform specific function
These techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.
| ID | Name | Sub-techniques | Examples |
|---|---|---|---|
| T1037 | Boot or Logon Initialization Scripts | 5 | 22 |
| T1053 | Scheduled Task/Job | 5 | 216 |
| T1055 | Process Injection | 12 | 239 |
| T1068 | Exploitation for Privilege Escalation | 0 | 43 |
| T1078 | Valid Accounts | 4 | 149 |
| T1098 | Account Manipulation | 7 | 45 |
| T1134 | Access Token Manipulation | 5 | 67 |
| T1484 | Domain or Tenant Policy Modification | 2 | 20 |
| T1543 | Create or Modify System Process | 5 | 198 |
| T1546 | Event Triggered Execution | 18 | 81 |
| T1547 | Boot or Logon Autostart Execution | 14 | 333 |
| T1548 | Abuse Elevation Control Mechanism | 6 | 75 |
| T1611 | Escape to Host | 0 | 5 |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
