T1068

Exploitation for Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of vulnerabilities can take place locally or remotely.

ATT&CK / Privilege Escalation

Defense strategies

  • Keep systems patched
  • Use exploit protection features
  • Implement least privilege
  • Application sandboxing

Detection methods

  • Monitor for unusual process behavior
  • Track privilege changes
  • Detect known exploit signatures

D3FEND mappings

3

T1068 on MITRE ATT&CK ↗