Privilege Escalation

Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.

Detect it with
Monitor logon scripts for unusual access by abnormal users or at abnormal times. Look for files added or modified by unusual accounts outside of normal administration duties.

schtasks, cron, at, and systemd timers used both to execute now and to survive a reboot.

Detect it with
Event ID 4698 (task created); new cron entries; tasks whose action points at a user-writable path.

Writing code into another live process to run under its identity and evade process-based controls.

Detect it with
CreateRemoteThread and cross-process memory writes; RWX memory regions with no backing file on disk.

Kernel and driver vulnerabilities, including bring-your-own-vulnerable-driver, used to reach SYSTEM or root.

Detect it with
Unsigned or known-vulnerable driver loads; process integrity level jumping without a legitimate elevation path.

Logging in with legitimate stolen credentials — the quietest way in and the hardest to distinguish from normal work.

Detect it with
Impossible travel, first-time ASN or country for the user, MFA fatigue patterns, logins outside the user's baseline hours.

Adding credentials to an existing account — SSH keys, app registrations, additional MFA devices.

Detect it with
New MFA method registered immediately after a suspicious sign-in; new service principal credentials in cloud audit logs.

Stealing or impersonating another process's token to inherit its privileges.

Detect it with
Process access with high-privilege rights (0x1410) against SYSTEM processes; SeDebugPrivilege use by unexpected binaries.

Group Policy and tenant-level trust changes that grant the adversary durable elevated rights.

Detect it with
GPO modifications outside change windows; new federated trust or domain added to the tenant.

Windows services, launch daemons, and systemd units created or hijacked for persistence.

Detect it with
Event ID 7045; new unit files in /etc/systemd/system; service binaries in unusual paths.

Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events.

Detect it with
Monitoring for additions or modifications of mechanisms that could be used to trigger event-based execution, especially the addition of abnormal commands such as execution of unknown programs, opening network sockets, or reaching out across the network.

Run keys, startup folders, Winlogon helpers, and LSA drivers that execute on boot or logon.

Detect it with
Registry writes to Run/RunOnce by non-installer processes; new files in Startup folders.

UAC bypasses, sudo abuse, setuid binaries, and elevated COM interfaces.

Detect it with
fodhelper.exe / computerdefaults.exe registry hijacks; sudo invocations by service accounts.

Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time.

Detect it with
Monitor file systems for moving, renaming, replacing, or modifying DLLs. Changes in the set of DLLs that are loaded by a process (compared with past behavior) that do not correlate with known software, patches, etc., are suspicious.

Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself.

Detect it with
Monitor for the deployment of suspicious or unknown container images and pods in your environment, particularly containers running as root.