TA0004 · PRIVILEGE ESCALATION
Exploitation for Privilege Escalation
Kernel and driver vulnerabilities, including bring-your-own-vulnerable-driver, used to reach SYSTEM or root.
Detect it with
Unsigned or known-vulnerable driver loads; process integrity level jumping without a legitimate elevation path.
Why it matters on shift
Exploitation for Privilege Escalation is one of the concrete ways adversaries achieve privilege escalation. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After privilege escalation, the next tactic is usually Defense Evasion. Search your telemetry for the transition before closing the ticket.
Kill-chain context