Exploitation for Privilege Escalation

T1068

About this technique

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

When initially gaining access to a system, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system. Vulnerabilities may exist, usually in operating system components and software commonly running at higher permissions, that can be exploited to gain higher levels of access on the system. This could enable someone to move from unprivileged or user level permissions to SYSTEM or root permissions depending on the component that is vulnerable. This could also enable an adversary to move from a virtualized environment, such as within a virtual machine or container, onto the underlying host. This may be a necessary step for an adversary compromising an endpoint system that has been properly configured and limits other privilege escalation methods.

Adversaries may bring a signed vulnerable driver onto a compromised machine so that they can exploit the vulnerability to execute code in kernel mode. This process is sometimes referred to as Bring Your Own Vulnerable Driver (BYOVD). Adversaries may include the vulnerable driver with files delivered during Initial Access or download it to a compromised system via Ingress Tool Transfer or Lateral Tool Transfer.

Detection rules72

Rules on DetectionCode tagged with T1068.

Sigma19

Rule	Level	Log source
Audit CVE Event	critical	windows / NULL
HackTool - SysmonEOP Execution	critical	windows / process_creation
Possible Coin Miner CPU Priority Param	critical	linux / NULL
Sudo Privilege Escalation CVE-2019-14287 - Builtin	critical	linux / NULL
Buffer Overflow Attempts	high	linux / NULL
HKTL - SharpSuccessor Privilege Escalation Tool Execution	high	windows / process_creation
Malicious Driver Load	high	windows / driver_load
Nimbuspwn Exploitation	high	linux / NULL
OMIGOD HTTP No Authentication RCE	high	zeek / NULL
OMIGOD SCX RunAsProvider ExecuteScript	high	linux / process_creation
OMIGOD SCX RunAsProvider ExecuteShellCommand	high	linux / process_creation
Process Explorer Driver Creation By Non-Sysinternals Binary	high	windows / file_event
Sudo Privilege Escalation CVE-2019-14287	high	linux / process_creation
Suspicious Spool Service Child Process	high	windows / process_creation
Vulnerable Driver Load	high	windows / driver_load
Malicious Driver Load By Name	medium	windows / driver_load
Process Monitor Driver Creation By Non-Sysinternals Binary	medium	windows / file_event
Linux Sudo Chroot Execution	low	linux / process_creation
Vulnerable Driver Load By Name	low	windows / driver_load

Splunk53

Rule	Type	Risk	Data source
Child Processes of Spoolsv exe	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Cisco Isovalent - Kprobe Spike	Hunting	NULL	Cisco Isovalent Process Kprobe
Detect Baron Samedit CVE-2021-3156	TTP	NULL
Detect Baron Samedit CVE-2021-3156 Segfault	TTP	NULL
Detect Baron Samedit CVE-2021-3156 via OSQuery	TTP	NULL
First Time Seen Child Process of Zoom	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Linux Apparmor Bypass Via Aaexec	TTP	NULL	Sysmon for Linux EventID 1
Linux Auditd Copy Fail Privilege Escalation	TTP	NULL	Linux Auditd Syscall
Linux Auditd Possible Setuid Execve Privesc	Anomaly	NULL	Linux Auditd Execve
Linux Binary Launched Process with Null Argv	TTP	NULL	Linux Messages Syslog
Linux Dirty Frag Kernel Privilege Escalation	TTP	NULL	Linux Auditd Syscall
Linux Ghostscript Exploitation	TTP	NULL	Sysmon for Linux EventID 1
Linux Malformed Auth Entry	Anomaly	NULL	Linux Secure
Linux Pedit Offset Out Of Bounds	TTP	NULL	Linux Messages Syslog
Linux PF_ALG Registration Outside of Boot Window	TTP	NULL	Linux Messages Syslog
Linux pkexec Privilege Escalation	TTP	NULL	Sysmon for Linux EventID 1
Linux Possible GSM Privilege Escalation	Anomaly	NULL	Sysmon for Linux EventID 1
Linux Possible Nimbuspwn Privilege Escalation	TTP	NULL	Sysmon for Linux EventID 1
Linux Possible Privilege Escalation via PYTHONPATH	TTP	NULL	Sysmon for Linux EventID 11
Linux Suspicious GCC Invocation Building Init Shared Object	TTP	NULL	Sysmon for Linux EventID 1
Linux Suspicious Namespace Creation	TTP	NULL	Linux Auditd Syscall, Sysmon for Linux EventID 1
Microsoft SharePoint Server Elevation of Privilege	Anomaly	NULL	Suricata
Spoolsv Suspicious Process Access	TTP	NULL	Sysmon EventID 10
VMWare Aria Operations Exploit Attempt	TTP	NULL	Palo Alto Network Threat
Windows Admin Password Changed by Non-Admin	TTP	NULL	Windows Event Log Security 4723
Windows Cloud Files Filter Log Created by Non-System Process	TTP	NULL	Sysmon EventID 11
Windows Defender Intermediary Artifact Was Observed	Anomaly	NULL	Sysmon EventID 11 AND Sysmon EventID 15 AND Sysmon EventID 23
Windows Defender MpClient.dll Loaded by Non-Defender Process	Anomaly	NULL	Sysmon EventID 7
Windows Defender Threat Detected on Kernel Object Path	TTP	NULL	Windows Event Log Defender 1116, Windows Event Log Defender 1117
Windows Driver Inventory	Hunting	NULL
Windows Driver Load Non-Standard Path	TTP	NULL	Windows Event Log System 7045
Windows Drivers Loaded by Signature	Hunting	NULL	Sysmon EventID 6
Windows Error Report Created in ReportQueue Manually	Anomaly	NULL	Sysmon EventID 11
Windows MSI Rollback Script Deleted By Non-Msiexec Process	TTP	NULL	Sysmon EventID 23, Sysmon EventID 26
Windows MsMpEng Writing to System32	TTP	NULL	Sysmon EventID 15, Sysmon EventID 11
Windows Non-System Process Querying Definition Update	Anomaly	NULL	Sysmon EventID 22
Windows Phantom DLL Created on Disk	TTP	NULL	Sysmon EventID 11
Windows Potato Privilege Escalation Tool Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Privilege Escalation Attempt Via MSI Rollback	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Privilege Escalation Suspicious Process Elevation	TTP	NULL	Sysmon EventID 1 AND Sysmon EventID 1
Windows Privilege Escalation System Process Without System Parent	TTP	NULL	Sysmon EventID 1
Windows Privilege Escalation User Process Spawn System Process	TTP	NULL	Sysmon EventID 1 AND Sysmon EventID 1
Windows Remote Image Load	Anomaly	NULL	Sysmon EventID 7
Windows SCCM Smsexec Spawned a Suspicious Child Process	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Service Create Kernel Mode Driver	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Suspicious Burst of Password Changes	TTP	NULL	Windows Event Log Security 4723, Windows Event Log Security 4724
Windows Suspicious Child Process of Consent.EXE	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Suspicious Child Process of TieringEngineService.exe	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Suspicious Defender Engine or Signature Files Created	Anomaly	NULL	Sysmon EventID 11
Windows Suspicious Defender Update Activity in INetCache	Anomaly	NULL	Sysmon EventID 11, Sysmon EventID 23
Windows System File on Disk	Hunting	NULL	Sysmon EventID 11
Windows VSSVC Process Accessing Defender Engine	TTP	NULL	Sysmon EventID 10
Windows Wermgr Spawning System Integrity Process	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2

Groups22

Software19

BlackByte 2.0 Ransomware Carberp Cobalt Strike CosmicDuke Embargo Empire Hildegard InvisiMole JHUHUGIT Pandora PoshC2 ProLock Remsec Siloscape Stuxnet Wingbird XCSSET ZeroCleare Zox

Campaigns2

Leviathan Australian Intrusions ShadowRay

Procedure examples43

Groups22

Used by	Procedure example
GroupAPT28	APT28 has exploited CVE-2014-4076, CVE-2015-2387, CVE-2015-1701, CVE-2017-0263, and CVE-2022-38028 to escalate privileges. Bitdefender APT28 Dec 2015 Microsoft SIR Vol 19 Nearest Neighbor Volexity Securelist Sofacy Feb 2018
GroupAPT29	APT29 has exploited CVE-2021-36934 to escalate privileges on a compromised host. ESET T3 Threat Report 2021
GroupAPT32	APT32 has used CVE-2016-7255 to escalate privileges. FireEye APT32 May 2017
GroupAPT33	APT33 has used a publicly available exploit for CVE-2017-0213 to escalate privileges on a local system. FireEye APT33 Guardrail
GroupBITTER	BITTER has exploited CVE-2021-1732 for privilege escalation. DBAPPSecurity BITTER zero-day Feb 2021 Microsoft CVE-2021-1732 Feb 2021
GroupBlackByte	BlackByte has exploited CVE-2024-37085 in VMWare ESXi software for authentication bypass and subsequent privilege escalation. Cisco BlackByte 2024
GroupCobalt Group	Cobalt Group has used exploits to increase their levels of rights and privileges. Group IB Cobalt Aug 2017
GroupFIN6	FIN6 has used tools to exploit Windows vulnerabilities in order to escalate privileges. The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges. FireEye FIN6 April 2016

View all 22 groups examples

Software19

Used by	Procedure example
MalwareBlackByte 2.0 Ransomware	BlackByte 2.0 Ransomware exploits a vulnerability in the RTCore64.sys driver (CVE-2019-16098) to enable privilege escalation and defense evasion when run as a service. Microsoft BlackByte 2023
MalwareCarberp	Carberp has exploited multiple Windows vulnerabilities (CVE-2010-2743, CVE-2010-3338, CVE-2010-4398, CVE-2008-1084) and a .NET Runtime Optimization vulnerability for privilege escalation. ESET Carberp March 2012 Prevx Carberp March 2011
MalwareCobalt Strike	Cobalt Strike can exploit vulnerabilities such as MS14-058. Cobalt Strike Manual 4.3 November 2020 Cobalt Strike TTPs Dec 2017
MalwareCosmicDuke	CosmicDuke attempts to exploit privilege escalation vulnerabilities CVE-2010-0232 or CVE-2010-4398. F-Secure The Dukes
MalwareEmbargo	Embargo has leveraged MS4Killer to deliver a vulnerable driver to the victim device, sometimes referred to as Bring Your Own Vulnerable Driver (BYOVD). Embargo has utilized the vulnerable driver probmon.sys version 3.0.0.4 which had a revoked certificated from “ITM System Co.,LTD.” ESET Embargo Ransomware October 2024
ToolEmpire	Empire can exploit vulnerabilities such as MS16-032 and MS16-135. Github PowerShell Empire
MalwareHildegard	Hildegard has used the BOtB tool which exploits CVE-2019-5736. Unit 42 Hildegard Malware
MalwareInvisiMole	InvisiMole has exploited CVE-2007-5633 vulnerability in the speedfan.sys driver to obtain kernel mode privileges. ESET InvisiMole June 2020

View all 19 software examples

Campaigns2

Used by	Procedure example
CampaignLeviathan Australian Intrusions	Leviathan exploited software vulnerabilities in victim environments to escalate privileges during Leviathan Australian Intrusions. CISA Leviathan 2024
CampaignShadowRay	During ShadowRay, threat actors downloaded a privilege escalation payload to gain root access. Oligo ShadowRay Campaign MAR 2024

References2

ESET InvisiMole June 2020 Open source
Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.
Unit42 AcidBox June 2020 Open source
Reichel, D. and Idrizovic, E. (2020, June 17). AcidBox: Rare Malware Repurposing Turla Group Exploit Targeted Russian Organizations. Retrieved March 16, 2021.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.