Technique
technique:privilege_escalation
Also: elevate their privileges, escalate privileges, escalated their privileges to root, escalating their privileges, escalation privileges
Obtaining higher-level system privileges after gaining an initial foothold.
Obtaining administrator credentials and access to more privileged banking systems.
“the next goal would be to elevate their privileges and get access to the domain controller.”
Obtaining higher-level system privileges after gaining an initial foothold.
“pivot, escalation privileges”
Technique used after obtaining a shell to elevate access to the root account.
“they were able to get a shell on the server which then they escalated their privileges to root”
Increasing access rights after compromising a system or network.
“create a persistent connection and elevate their privileges”
Moving from a lower-privileged Office 365 account to an account with super-administrator access.
“He’s done what’s called privilege escalation.”
“I found three accounts with – in particular which had super administrator access”
Obtaining higher privileges after initial compromise in order to reach protected systems and wallets.
“pivoting and escalating their privileges”
Obtaining higher privileges, including domain administrator-level access, during an intrusion.
“as well as escalate privileges”
“they’ve escalated their privileges to domain administrator level”
Technique used to promote a low-level user to an account with administrator rights.
“the malware’s purpose was to escalate privileges”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | INVOLVES | Carbanak | Explicit | 35 |
| incoming | USES | Tinker Secor | Explicit | 36 |
| incoming | USES | Adam Georgeson | Explicit | 113 |
| incoming | INVOLVES | Unnamed IT company network attack | Explicit | 113 |
| incoming | INVOLVES | NiceHash hack | Explicit | 119 |
| incoming | USES | REvil | Explicit | 126 |
Carbanak INVOLVES privilege escalation
The attackers attempted to elevate privileges by obtaining administrator passwords.
Explicit Confidence 99% · Jack Rhysider EP 35 Details
“the next goal would be to elevate their privileges and get access to the domain controller”
Tinker Secor USES privilege escalation
Tinker includes privilege escalation in his standard approach and attempts to escalate to system level.
Explicit Confidence 98% · Tinker Secor EP 36 Details
“escalation privileges, actions and target”
Adam Georgeson USES privilege escalation
Adam escalated from a lower-level Office 365 account to an account with super-administrator rights.
Explicit Confidence 99% · Jack Rhysider EP 113 Details
“He’s done what’s called privilege escalation.”
Unnamed IT company network attack INVOLVES privilege escalation
The later attack involved moving from the Office 365 portal to the global administrator account.
Explicit Confidence 98% · Jack Rhysider EP 113 Details
“From there, he gets access to the global administrator account”
NiceHash hack INVOLVES privilege escalation
The attackers escalated their privileges while moving through the NiceHash network.
Explicit Confidence 99% · Jack Rhysider EP 119 Details
“pivoting and escalating their privileges”
REvil USES privilege escalation
REvil attackers escalated privileges to domain-administrator level before deploying the ransomware.
Explicit Confidence 99% · Will EP 126 Details
“they’ve escalated their privileges to domain administrator level”