Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
When initially gaining access to a system, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system. Vulnerabilities may exist, usually in operating system components and software commonly running at higher permissions, that can be exploited to gain higher levels of access on the system. This could enable someone to move from unprivileged or user level permissions to SYSTEM or root permissions depending on the component that is vulnerable. This could also enable an adversary to move from a virtualized environment, such as within a virtual machine or container, onto the underlying host. This may be a necessary step for an adversary compromising an endpoint system that has been properly configured and limits other privilege escalation methods.
Adversaries may bring a signed vulnerable driver onto a compromised machine so that they can exploit the vulnerability to execute code in kernel mode. This process is sometimes referred to as Bring Your Own Vulnerable Driver (BYOVD).(Citation: ESET InvisiMole June 2020)(Citation: Unit42 AcidBox June 2020) Adversaries may include the vulnerable driver with files delivered during Initial Access or download it to a compromised system via Ingress Tool Transfer or Lateral Tool Transfer.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| DE.AE-02.01 | Event analysis and detection | Mitigates | T1068 | Exploitation for Privilege Escalation |
Comments
This diagnostic statement provides for implementation of methods to block similar future attacks via security tools such as antivirus and IDS/IPS to provide protection against threats and exploitation attempts.
References
|
| PR.PS-06.06 | Vulnerability remediation | Mitigates | T1068 | Exploitation for Privilege Escalation |
Comments
This diagnostic statement provides for identifying and remediating vulnerabilities as part of the SDLC. Ensuring software is up-to-date with the latest security patches helps prevent adversaries from exploiting known vulnerabilities, reducing the risk of successful attacks.
References
|
| PR.PS-06.05 | Testing and validation strategy | Mitigates | T1068 | Exploitation for Privilege Escalation |
Comments
This particular diagnostic statement highlights the use of software security testing, code integrity verifications, and vulnerability scanning to mitigate security weaknesses and vulnerabilities in developed code or applications that an adversary may be able to take advantage of.
References
|
| PR.PS-02.01 | Patch identification and application | Mitigates | T1068 | Exploitation for Privilege Escalation |
Comments
This diagnostic statement is related to the implementation of a patch management program. Applying patches and upgrades for products and systems provided by vendors mitigates the risk of adversaries exploiting known vulnerabilities. For example, updating software regularly by employing patch management for internal enterprise endpoints and servers can help prevent adversary exploitation of software vulnerabilities to elevate privileges.
References
|
| PR.PS-01.09 | Virtualized end point protection | Mitigates | T1068 | Exploitation for Privilege Escalation |
Comments
The diagnostic statement highlights several mechanisms that organizations can implement to protect endpoint systems using virtualization technologies. Virtualization technologies provide a layer of isolation and containment to isolate and contain the impact of potential compromises. When it comes to this exploitation technique, consider making it difficult for adversaries to advance their operation through exploitation of undiscovered or unpatched vulnerabilities by using sandboxing. Other types of virtualization and application microsegmentation may also mitigate the impact of some types of exploitation.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CVE-2021-29256 | Arm Mali GPU Kernel Driver Use-After-Free Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an unprivileged attacker by conducting malicious activity in GPU memory, gaining access to already freed memory. If successful, the threat actor could escalate their privileges to root as well as gain access to sensitive information. Detailed information about how adversaries exploit the GPU are not publicly available.
References
|
| CVE-2025-21335 | Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability, if exploited, would allow an adversary to obtain SYSTEM-level privileges, resulting in total system compromise.
References
|
| CVE-2025-21334 | Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability, if exploited, would allow an adversary to obtain SYSTEM-level privileges, resulting in total system compromise.
References
|
| CVE-2025-24085 | Apple Multiple Products Use-After-Free Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
The use-after-free vulnerability present in various Apple device versions (that have since been patched out) allows for a malicious application to escalate its priviliges within the system.
References
|
| CVE-2025-32709 | Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
This use-after-free vulnerability in Windows has been exploited by attackers to gain SYSTEM-level privileges, leading to remote code execution, full system compromise, the modification of system processes to establish persistence on the machine, and the deployment of malware such as credential harvesters and ransomware.
References
|
| CVE-2025-32701 | Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
This zero-day vulnerability has been exploited by attackers to gain SYSTEM-level privileges in Windows, leading to remote code execution, as well as the ability to disable security tools, deploy malicious payloads, and extract credentials from memory.
References
|
| CVE-2025-30400 | Microsoft Windows DWM Core Library Use-After-Free Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability has been exploited to escalate an attacker's privileges to SYSTEM-level via Microsoft Windows Desktop Window Manager (DWM) Core Library, allowing the attacker to take significant actions such as registry modification.
References
|
| CVE-2021-22900 | Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited through multiple unrestricted uploads. Adversaries with authenticated administrator privileges leverage this vulnerability to perform unauthorized file writes on the system via a maliciously crafted archive upload within the administrator web interface in Pulse Connect Secure.
References
|
| CVE-2025-25257 | Fortinet FortiWeb SQL Injection Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
Affected versions of FortiWeb contain insufficient input sanitization, allowing for an attacker to use SQL injection to write a malicious .pth file to the into FortiWeb's site-packages Python directory. This allows the malicious code to execute using the privileges granted to Python scripts in that high-level directory. Given the use of SQL, this can lead to potential loss of data within the database.
References
|
| CVE-2025-25181 | Advantive VeraCore SQL Injection Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability exists in the timeoutwarning.asp file in VeraCore versions up to 2025.1.0 and allows an attacker to execute commands due to a lack of proper input sanitization, leading to effects such as privilege escalation and data destruction.
References
|
| CVE-2014-0546 | Adobe Acrobat and Reader Sandbox Bypass Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability allows bypassing sandbox protection and run native code.
References
|
| CVE-2024-38080 | Microsoft Windows Hyper-V Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This zero-day vulnerability presents itself after an adversary has already infiltrated the victim's network and enables the adversary to obtain SYSTEM level privileges via Microsoft Windows Hyper-V product. As of now, details of how the attacker's methods to exploit this vulnerability are undisclosed.
References
|
| CVE-2024-30051 | Microsoft DWM Core Library Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is a zero-day exploit that is believed to still be utilized by various adversarial groups leading to limited publicly available exploitation information. The vulnerability is a "heap-based protector flood susceptibility impacting the Windows DWM Core Library" enabling an adversary to gain SYSTEM privileges.
References
|
| CVE-2023-28252 | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain full SYSTEM level privileges.
This CVE has been leveraged in the wild by Storm-0506 involved deploying Black Basta ransomware, initiated through a Qakbot infection and exploiting a Windows vulnerability (CVE-2023-28252) to gain elevated privileges. The attackers used tools like Cobalt Strike and Pypykatz for credential theft and lateral movement, eventually creating an "ESX Admins" group to encrypt the ESXi file system and disrupt hosted VMs.
Based on the described exploitation of CVE-2023-28252 and the associated attack activities, the following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) could be linked to this CVE:
References
|
| CVE-2023-28229 | Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an adversary that has gained local access to the victim system. If successfully exploited, the adversary would gain limited SYSTEM level privileges.
This vulnerability has been exploited in the wild; however, no technical information has been published related to the exploitation. Microsoft has identified that successful exploitation of this vulnerability requires an attacker to win a race condition.
References
|
| CVE-2023-21674 | Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an authenticated adversary. It is identified as requiring local access via Microsoft; however, other reports have identified remote, authenticated adversaries can exploit this vulnerability. A successful exploitation would grant an attacker SYSTEM level privileges.
This vulnerability has been exploited in the wild; however, technical details of how this was leveraged in an attack has not been publicly shared.
References
|
| CVE-2022-41125 | Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an attacker who has obtained local access with low privileges on the target system. The vulnerability lies in the Cryptography API: Next Generation (CNG) Key Isolation Service, specifically due to a memory overflow issue. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary commands with SYSTEM privileges, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.
The exploit in question is actively being used in the wild. It involves exploiting the memory overflow in the CNG Key Isolation Service to gain SYSTEM-level access. Once the vulnerability is exploited, attackers can manipulate system processes and access sensitive information stored in the service, such as cryptographic keys. This allows them to achieve their objectives, such as executing code with elevated privileges and compromising the security of the affected system.
References
|
| CVE-2022-41073 | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an attacker who has obtained access to manipulate the Print Spooler service on the target system. The vulnerability lies in the Print Spooler, specifically involving XML manipulation and path traversal to a writable path containing a modified version of the `prntvpt.dll` file. This vulnerability has been exploited by threat actors to load unauthorized code on Windows systems. Attackers leveraged this flaw to execute arbitrary code, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities.
The exploit in question is actively being used in the wild. It involves exploiting the path traversal vulnerability to load a malicious DLL by manipulating the Print Spooler service. Once the vulnerability is exploited, attackers can bypass impersonation controls to load untrusted resources, thereby executing arbitrary code with elevated privileges.
References
|
| CVE-2022-41033 | Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
CVE-2022-41033 is exploited by an attacker who has obtained access to the target system. The vulnerability lies in the Windows COM+ Event System Service, due to improper handling of privilege escalation scenarios. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary system commands, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities.
The exploit in question is actively being used in the wild, primarily in targeted attacks. It involves pairing the elevation of privilege vulnerability with other code-execution exploits, often through social engineering tactics such as enticing a user to open a malicious attachment or visit a harmful website. Once the vulnerability is exploited, attackers can manipulate system privileges to perform arbitrary actions with SYSTEM-level permissions. This allows them to achieve their objectives, such as installing programs, viewing or changing data, and creating new accounts with full user rights.
References
|
| CVE-2022-37969 | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an attacker who has obtained access to the target system. The vulnerability lies in the Windows Common Log File System (CLFS) Driver, specifically due to improper bounds checking on the `cbSymbolZone` field in the Base Record Header for the base log file (BLF). This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary system commands, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities.
The exploit in question is actively being used in the wild, primarily in targeted attacks. It involves setting the `cbSymbolZone` field to an invalid offset, triggering an out-of-bound write that corrupts a pointer to the CClfsContainer object. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary actions with SYSTEM-level privileges. This allows them to achieve their objectives, such as disabling security applications and gaining full control over the compromised system.
References
|
| CVE-2022-26904 | Microsoft Windows User Profile Service Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an adversary who has already gained local access to the victim system. To exploit this vulnerability, the adversary needs to already have access to the system and must also "win a race condition". If successfully exploited, the adversary would gain elevated privileges on the victim system.
This vulnerability has been identified as exploited in the wild; however, technical exploitation details have not been publicly shared.
References
|
| CVE-2022-24521 | Microsoft Windows CLFS Driver Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an attacker who has already obtained access to a target system to execute code. The vulnerability lies in the Common Log File System (CLFS) driver, specifically in the `CClfsBaseFilePersisted::LoadContainerQ()` function, due to a logic bug in handling container context objects. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary code with system-level privileges, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.
The exploit in question is actively being used in the wild, primarily in ransomware campaigns. It involves corrupting the `pContainer` field of a container context object with a user-mode address by using malformed BLF files. Once the vulnerability is exploited, attackers can manipulate memory to execute code with elevated privileges. This allows them to achieve their objectives, such as stealing the System token and gaining full control over the compromised system.
References
|
| CVE-2022-22718 | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is leveraged by an adversary who has already gained local access to the victim system. The adversary exploits this vulnerability to elevate their privileges on the system via the Print Spooler, which could give the adversary the ability to distribute and install malicious programs on victims’ computers that can steal stored data
This vulnerability has been actively exploited by cybercriminals to gain unauthorized access to corporate networks and resources. Details about who is exploiting this vulnerability and their exact movements have not been publicly shared.
References
|
| CVE-2022-22047 | Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an attacker who has obtained local access tothe target system. The vulnerability lies in the Client Server Run-Time Subsystem (CSRSS) on Windows, specifically in the activation context caching mechanism, due to improper handling of crafted assembly manifests. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary system-level commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.
The exploit in question is actively being used in the wild, primarily in targeted attacks. It involves creating a malicious activation context by providing a crafted assembly manifest, which is cached and used the next time the process spawns. Once the vulnerability is exploited, attackers can load a malicious DLL to achieve system-level code execution. This allows them to achieve their objectives, such as executing arbitrary code with elevated privileges, with the same permissions as the compromised system's user.
References
|
| CVE-2022-21999 | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an adversary who already has access to the victim system. This vulnerability, also known as SpoolFool, is a local privilege escalation vulnerability in the Windows Print Spooler service, which manages print operations on Windows systems. This vulnerability allows attackers to execute code with SYSTEM-level privileges by exploiting the `SpoolDirectory` configuration setting. The `SpoolDirectory` is writable by all users and can be manipulated using the `SetPrinterDataEx()` function, provided the attacker has `PRINTER_ACCESS_ADMINISTER` permissions.
The exploit involves creating a directory junction and using a Universal Naming Convention (UNC) path to write a malicious DLL to a privileged directory, such as `C:\Windows\System32\spool\drivers\x64\4`. This DLL is then loaded and executed by the Print Spooler service, granting the attacker elevated privileges. This method circumvents previous security checks designed to prevent privilege escalation through the Print Spooler.
The vulnerability has been exploited in the wild, with attackers using tools like the SpoolFool proof of concept (PoC) published on GitHub. One observed attack involved creating a local administrator account with a default password, indicating the potential for significant system compromise. The Gelsemium APT group has been linked to activity exploiting this vulnerability, highlighting its use in advanced persistent threat campaigns.
References
|
| CVE-2022-21919 | Microsoft Windows User Profile Service Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an adversary who has already gained local access to the victim system. The adversary gains access to the vulnerability either by social engineering, a separate exploit, or malware. Exploiting this vulnerability grants the adversary elevated privileges on the victim system.
This vulnerability has been identified as being exploited in the wild; however, technical details of how the vulnerability has been leveraged by a hacker or APT have not been publicly released.
References
|
| CVE-2021-41379 | Microsoft Windows Installer Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
The vulnerability in Microsoft Windows allows local attackers to escalate privileges by exploiting a flaw in the Windows Installer service. By creating a junction, attackers can delete targeted files or directories, potentially executing arbitrary code with SYSTEM privileges. However, attackers must already have access and the ability to execute low-privileged code on the target system to exploit this vulnerability.
This vulnerability has been identified as exploited in the wild; however, specific details on how the vulnerability was exploited have not been publicly released.
References
|
| CVE-2021-40449 | Microsoft Windows Win32k Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an attacker who has obtained administrative console access on the target system. The vulnerability lies in the Win32k driver, specifically in the NtGdiResetDC function, due to improper handling of user-mode callbacks. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows servers. Attackers leveraged this flaw to execute arbitrary kernel commands, allowing them to manipulate system processes and deploy additional malware to perform further malicious activities.
The exploit in question is actively being used in the wild, primarily in espionage campaigns. It involves triggering a use-after-free condition by executing the ResetDC function a second time for the same handle during a callback. Once the vulnerability is exploited, attackers can manipulate memory to perform arbitrary kernel function calls with controlled parameters. This allows them to achieve their objectives, such as reading and writing kernel memory, with the same permissions as the compromised system's user.
References
|
| CVE-2021-36934 | Microsoft Windows SAM Local Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by a local or remote adversary who already has access to the system. The vulnerability enables the attacker to elevate their privileges due to over permissive ACLs on system file and elevate their privileges to SYSTEM level. By exploiting this vulnerability an attacker could gain the ability to run arbitrary code, install programs, view/modify/delete data, or create new user accounts with full rights.
References
|
| CVE-2021-33739 | Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
Local escalation of privilege attack. Attacker would most likely gain access through an executable or script on the local computer sent to the user via an email attachment.
References
|
| CVE-2020-1472 | Microsoft Netlogon Privilege Escalation Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
CVE-2020-1472, an elevation of privilege vulnerability in Microsoft’s Netlogon. A remote attacker can exploit this vulnerability to breach unpatched Active Directory domain controllers and obtain domain administrator access.
References
|
| CVE-2019-0211 | Apache HTTP Server Privilege Escalation Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
CVE-2019-0211 is a privilege escalation vulnerability in Apache HTTP Server with MPM event, worker, or prefork that allows an attacker to execute code with the privileges of that parent process (usually root).
References
|
| CVE-2025-21391 | Microsoft Windows Storage Link Following Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
Exploiting this link-following vulnerability can lead to privilege escalation, with the primary result being deletion of system data. As a consequence of this, deletion of certain files could also make the recovery process more difficult.
References
|
| CVE-2025-1976 | Broadcom Brocade Fabric OS Code Injection Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
Brocade Fabric OS versions 9.1.0 through 9.1.1d6 contain an improper IP validation flaw that allows a user with valid administrative access to escalate their privileges further, allowing for root-level code execution.
References
|
| CVE-2024-12686 | BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
No public proof-of-concept for this exploit exists, but an attacker with existing administrative privileges can exploit this vulnerability can execute arbitrary commands at a higher privilege level.
References
|
| CVE-2025-0111 | Palo Alto Networks PAN-OS File Read Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
This exploit is part of a chain of exploits (with CVE-2025-0108 and CVE-2024-9474) that can end with an attacker gaining root access to the system. After bypassing authentication with CVE-2025-0108, the attacker can exploit this to gain read access to system files with "nobody" privileges.
References
|
| CVE-2024-29059 | Microsoft .NET Framework Information Disclosure Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
This information disclosure vulnerability allows an attacker to gain access to ObjRef URI, which can be leveraged to facilitate remote code execution and privilege escalation.
References
|
| CVE-2020-0787 | Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
CVE-2020-0787 is a privilege elevation vulnerability in the Windows Background Intelligent Transfer Service (BITS). An actor can exploit this vulnerability if it improperly handles symbolic links to execute arbitrary code with system-level privileges.
References
|
| CVE-2022-22948 | VMware vCenter Server Incorrect Default File Permissions Vulnerability | secondary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an adversary who has gained access to a valid account on the vCenter Server. The adversary can gain access to unencrypted Postgres credentials on the server, which grants the adversary access to the vCenter's internal database where the vpxuser account passphrase is stored. Adversaries can leverage this information to decrypt the vpxuser password, which will grant them root privileges.
References
|
| CVE-2024-4577 | PHP-CGI OS Command Injection Vulnerability | secondary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
CVE-2024-4577 is a PHP argument injection vulnerability that allows an adversary to execute arbitrary php commands. Threat actors have been observed utilizing Cobalt Strike and the TaoWu toolkit for post-exploitation activities, such as conducting reconnaisance, establishing persistence, escalating privileges to SYSTEM level, and harvesting credentials.
References
|
| CVE-2023-20273 | Cisco IOS XE Web UI Command Injection Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited through improper privilege escalation in the Web User Interface feature of Cisco IOS XE software. Attackers first used this vulnerability to elevate privileges from a normal user to root by leveraging a newly created local user account. This allowed them to write malicious implants that enable them to execute arbitrary commands to the file system
This CVE was exploited after the adversary exploited CVE-2023-20198.
References
|
| CVE-2024-41710 | Mitel SIP Phones Argument Injection Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
Improper input sanitization in the Mitel 6869i SIP Phone, firmware version 6.3.0.1020 can be exploited to obtain root access on the device and execute arbitrary code.
References
|
| CVE-2024-12987 | DrayTek Vigor Routers OS Command Injection Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
An unauthenticated, remote attacker can exploit this vulnerability to escalate privileges and execute arbitrary code with root access.
References
|
| CVE-2023-44221 | SonicWall SMA100 Appliances OS Command Injection Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
This post-authentication command injection vulnerability is chained with CVE-2024-38475 to allow command execution as the nobody user, affecting versions below 10.2.1.10-62sv.
References
|
| CVE-2023-33538 | TP-Link Multiple Routers Command Injection Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
End-of-life TP-Link routers contain an improper input sanitization flaw that attackers can exploit by sending specially crafted HTTP GET requests to the web interface, leading to privilege escalation and arbitrary code execution.
References
|
| CVE-2022-20708 | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by bypassing user authentication mechanisms via a lack of proper validation of a user-supplied string before executing a system call. This could grant adversaries root access to execute arbitrary code.
References
|
| CVE-2025-24993 | Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
This heap-based buffer overflow vulnerability in Windows NTFS allows an attacker to elevate to SYSTEM-level privileges. This vulnerability can be exploited via malicious virtual hard disk (VHD) files that can be mounted by a system user, leading to code execution.
References
|
| CVE-2025-21333 | Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability, if exploited, would allow an adversary to obtain SYSTEM-level privileges, resulting in total system compromise.
References
|
| CVE-2025-21418 | Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
Exploiting this buffer overflow vulnerability could lead to an adversary gaining elevated privileges on the machine, leading to the potential for process injection using malicious code, as well as data loss.
References
|
| CVE-2025-32706 | Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
Attackers have exploited this heap-based buffer overflow vulnerability to escalate their privileges to SYSTEM-level, allowing them to execute arbitrary code, disable security tools, deploy malicious payloads, and extract credentials from memory.
References
|
| CVE-2022-47966 | Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
CVE-2022-47966 is a remote code execution vulnerability that affects many ManageEngine products due to misconfiguration of security features. Adversaries can utilized this vulnerability to run arbitrary java. APTs have been observed exploiting this vulnerability to gain access, to public-facing applications, establish persistence, and move laterally.
They've also been observed to create local user accounts with administrative privileges, use valid but disabled user accounts, delete logs, establish command and control communications, ... **the list goes on and on due to fantastic, detailed reporting**
References
|
| CVE-2023-20118 | Cisco Small Business RV Series Routers Command Injection Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
Cisco Small Business Router models RV016, RV042, RV042G, RV082, RV320, and RV325 perform improper validation of HTTP packet user input. An authenticated attacker can craft these requests and send them, leading to arbitrary command execution.
References
|
| CVE-2020-0069 | Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
CVE-2020-0069 is an insufficient input validation vulnerability in multiple MediaTek chipsets that, combined with missing SELinux restrictions in the Command Queue drivers' ioctl handlers, allows an adversary to perform an out-of-bounds write leading to privilege escalation.
References
|
| CVE-2025-47812 | Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
An attacker can craft a message in Lua that injects a null byte, allowing admin access to Wing FTP sessions.
References
|
| CVE-2021-4034 | Red Hat Polkit Out-of-Bounds Read and Write Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
The Polkit/Pwnkit vulnerability (CVE-2021-4034) is a critical vulnerability impacting every major Linux distribution. Its attack vector allows privilege escalation and can even give the attacker root access.
References
|
| CVE-2025-22225 | VMware ESXi Arbitrary Write Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability, present in VMWare ESXi, Workstation, and Fusion, allows an attacker with VMX process privileges to write in the kernel memory, triggering a sandbox escape.
References
|
| CVE-2024-53197 | Linux Kernel Out-of-Bounds Access Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
Using a malicious USB device, an attacker can trigger an out-of-bounds heap write in the kernel, allowing the attacker to obtain root access and potentiall execute arbitrary code.
References
|
| CVE-2024-53104 | Linux Kernel Out-of-Bounds Write Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
By creating or modifying a USB video device, an attacker can send an undefined video frame to trigger an out-of-bounds write, leading to privilege escalation and potential arbitrary code execution.
References
|
| CVE-2024-37085 | VMware ESXi Authentication Bypass Vulnerability | primary_impact | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability is exploited by an adversary who has already exploited an ESXi system and gained access to a valid account. Using this account, the adversary creates a new AD group named "ESXi Admins" that the ESXi Hypervisor grants full admin privileges. Adversary groups such as Storm-0506, Storm-1175, Octo Tempest, and Manatee Tempest have leveraged this vulnerability to deploy ransomware known as Akira and Black Basta onto compromised environments.
References
|
| CVE-2024-55591 | Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
An attacker can add a local_access_token parameter to a request targeting a specific endpoint on vulnerable Fortinet devices, leading to an authentication bypass. From there, they can obtain super_admin privileges.
References
|
| CVE-2024-54085 | AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
By sending a malicious request to the Redfish Host Interface, an attacker can manipulate the HTTP header, tricking the Baseboard Management Controller (BMC) into thinking that the request originates from a trusted source, leading to authentication bypass. This can lead to complete system control, deployment of malware at the firmware level, and network disruptions.
References
|
| CVE-2021-32030 | ASUS Routers Improper Authentication Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
Due to the router's administrative web-app having improper validation of session cookies, an unauthorized user can gain administrative access to the device management interface.
References
|
| CVE-2025-54309 | CrushFTP Unprotected Alternate Channel Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
Improper validation of AS2 messages in CrushFTP without DMZ proxy enabled were reported to be exploited to bypass authentication and gain administrative access over HTTPS, leading to system compromise, data exfiltration, and lateral movement.
References
|
| CVE-2024-49035 | Microsoft Partner Center Improper Access Control Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
The details of this exploit are not publicly disclosed, but due to improper access controls in the Microsoft Power Apps backend, attackers can potentially escalate their privileges, affecting the Partner Center web portal and putting the data stored there at risk.
References
|
| CVE-2025-21590 | Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
This vulnerability allows for an adversary to escalate their privileges within the system, allowing them to execute arbitrary code.
References
|
| CVE-2025-0994 | Trimble Cityworks Deserialization Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
A deserialization vulnerability in Trimble Cityworks versions before 15.8.9 (and Cityworks with Office Companion versions prior to 23.10) can be exploited by attackers using maliciously crafted serialized objects to the server, ending with escalated privileges permitting the execution remote code against a target's Microsoft IIS web server.
References
|
| CVE-2024-4885 | Progress WhatsUp Gold Path Traversal Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
By sending a crafted payload to a vulnerable WhatsUp Gold server, an attacker can conduct a path traversal attack and write malicious files onto the server. This leads to high-privileged remote code execution.
References
|
| CVE-2024-41713 | Mitel MiCollab Path Traversal Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
This path traversal vulnerability can lead to privilege escalation on MiCollab, which can then lead to other exploits such as CVE-2024-55550.
References
|
| CVE-2025-4632 | Samsung MagicINFO 9 Server Path Traversal Vulnerability | exploitation_technique | T1068 | Exploitation for Privilege Escalation |
Comments
By exploiting a path traversal vulnerability in Samsung MagicINFO 9 Server, an unauthenticated attacker can write arbitrary files with system privileges. This can be used to deploy malware or to hijack resources for activity such as cryptocurrency mining.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| microsoft_sentinel | Microsoft Sentinel | technique_scores | T1068 | Exploitation for Privilege Escalation |
Comments
The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect the use of Empire, which can exploit known system vulnerabilities, but does not explicitly address other procedures.
References
|
| docker_host_hardening | Microsoft Defender for Cloud: Docker Host Hardening | technique_scores | T1068 | Exploitation for Privilege Escalation |
Comments
This control may provide recommendations on how to reduce the surface area and mechanisms by which an attacker could escalate privileges.
References
|
| ai_security_recommendations | Microsoft Defender for Cloud: AI Security Recommendations | technique_scores | T1068 | Exploitation for Privilege Escalation |
Comments
This control's "Container with privilege escalation should be avoided", "Least privileged Linux capabilities should be enforced for containers", "Privileged containers should be avoided", "Running containers as root user should be avoided" and "Containers sharing sensitive host namespaces should be avoided" recommendations can make it difficult for adversaries to advance their operation through exploitation of undiscovered or unpatched vulnerabilities. Because this is a recommendation, the assessed score has been capped at Partial.
References
|
| alerts_for_linux_machines | Alerts for Linux Machines | technique_scores | T1068 | Exploitation for Privilege Escalation |
Comments
This control may alert on suspicious arguments used to exploit Xorg vulnerabilities for privilege escalation.
References
|
| alerts_for_windows_machines | Alerts for Windows Machines | technique_scores | T1068 | Exploitation for Privilege Escalation |
Comments
This control's Fileless Attack Detection identifies shellcode executing within process memory, including shellcode executed as a payload in the exploitation of a software vulnerability. Detection is periodic at an unknown rate. The following alerts may be generated: "Fileless attack technique detected", "Fileless attack behavior detected", "Fileless attack toolkit detected", "Suspicious SVCHOST process executed".
References
|
| azure_policy | Azure Policy | technique_scores | T1068 | Exploitation for Privilege Escalation |
Comments
This control may provide recommendations for vulnerability assessment and outdated applications and cloud services. This control covers a wide range of Azure cloud services to help reduce the surface area for exploitation.
References
|
| azure_update_manager | Azure Update Manager | technique_scores | T1068 | Exploitation for Privilege Escalation |
Comments
This control provides significant coverage of methods that leverage vulnerabilities in unpatched software since it enables automated updates of software and rapid configuration change management
References
|
| defender_for_app_service | Microsoft Defender for Cloud: Defender for App Service | technique_scores | T1068 | Exploitation for Privilege Escalation |
Comments
This control's Fileless Attack Detection identifies shellcode executing within process memory, including shellcode executed as a payload in the exploitation of a software vulnerability. Detection is periodic at an unknown rate.
References
|
| defender_for_azure_sql_databases | Microsoft Defender for Azure SQL Databases | technique_scores | T1068 | Exploitation for Privilege Escalation |
Comments
This control may scan for users with unnecessary permissions and if SQL Server is out of date.
References
|
| defender_for_containers | Microsoft Defender for Containers | technique_scores | T1068 | Exploitation for Privilege Escalation |
Comments
This control may provide recommendations to avoid privileged containers and running containers as root.
References
|
| defender_for_containers | Microsoft Defender for Containers | technique_scores | T1068 | Exploitation for Privilege Escalation |
Comments
This control may alert on detection of new privileged containers and high privilege roles.
References
|
| defender_for_resource_manager | Microsoft Defender for Resource Manager | technique_scores | T1068 | Exploitation for Privilege Escalation |
Comments
This control may alert on escalation attempts from Azure AD to Azure accounts by specific exploitation toolkits. Consequently, its Coverage score is Minimal resulting in an overall Minimal score. The following alerts may be generated: "PowerZure exploitation toolkit used to elevate access from Azure AD to Azure".
References
|
| vulnerability_management | Microsoft Defender for Cloud: Vulnerability Management | technique_scores | T1068 | Exploitation for Privilege Escalation |
Comments
Once this control is deployed, it can detect known vulnerabilities in Windows and various Linux endpoints. This information can be used to patch, isolate, or remove vulnerable software and machines. This control does not directly protect against exploitation and it is not effective against zero day attacks, vulnerabilities with no available patch, and software that may not be analyzed by the scanner. As a result, the score is capped at Partial.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| artifact_analysis | Artifact Analysis | technique_scores | T1068 | Exploitation for Privilege Escalation |
Comments
Artifact Analysis performs vulnerability scans on artifacts in Artifact Registry or Container Registry (deprecated). When Artifact Analysis is deployed, it can detect known Linux OS package vulnerabilities in various containers (e.g., Debian, Ubuntu, Alpine, RHEL, CentOS).
References
|
| artifact_analysis | Artifact Analysis | technique_scores | T1068 | Exploitation for Privilege Escalation |
Comments
Artifact Analysis scans container images uploaded to Artifact Registry or Container Registry (deprecated) for known software vulnerabilities and various system artifacts that could potentially be used to execute adversary-controlled code. Due to the medium threat protection coverage and temporal factor, this control was scored as partial.
References
|
| google_secops | Google Security Operations | technique_scores | T1068 | Exploitation for Privilege Escalation |
Comments
Google Security Ops is able to trigger alert based on suspicious command line behavior that could indicate remote code exploitation attempts (e.g., detect exploits using child processes spawned by Windows DNS processes).
This technique was scored as minimal based on low or uncertain detection coverage factor.
https://github.com/chronicle/detection-rules/blob/783e0e5947774785db1c55041b70176deeca6f46/soc_prime_rules/proactive_exploit_detection/process_creation/cve_2020_1350_dns_remote_code_exploit__sigred___via_cmdline.yaral
References
|
| policy_intelligence | Policy Intelligence | technique_scores | T1068 | Exploitation for Privilege Escalation |
Comments
Policy Intelligence role recommendations generated by IAM Recommender help admins remove unwanted access to GCP resources by using machine learning to make smart access control recommendations. With Recommender, security teams can automatically detect overly permissive access and rightsize them based on similar users in the organization and their access patterns. This control may mitigate adversaries that try to perform privilege escalation via permission levels and software exploitation.
References
|
| vm_manager | VM Manager | technique_scores | T1068 | Exploitation for Privilege Escalation |
Comments
VM Manager can apply on-demand and scheduled patches via automated patch deployment. This can remediate OS and software vulnerabilities that could otherwise be exploited. Since VM Manager doesn't directly prevent exploitation of active vulnerabilities (including zero day vulnerabilities) this control has resulted in a score of Partial.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| amazon_inspector | Amazon Inspector | technique_scores | T1068 | Exploitation for Privilege Escalation |
Comments
Amazon Inspector can detect known vulnerabilities on various Windows and Linux endpoints. Furthermore, the Amazon Inspector Best Practices assessment package can assess security controls for "Enable Address Space Layout Randomization (ASLR)" and "Enable Data Execution Prevention (DEP)" that makes it more difficult for an attacker to exploit vulnerabilities in software. This information can be used to patch, isolate, and remove vulnerable software and endpoints. Amazon Inspector does not directly protect against exploitation and it is not effective against zero-day attacks, vulnerabilities with no available patch, and software that may not be analyzed by the scanner. As a result, the score is capped at Partial.
References
|
| aws_config | AWS Config | technique_scores | T1068 | Exploitation for Privilege Escalation |
Comments
The "ec2-managedinstance-applications-blacklisted" managed rule verifies that a pre-defined list of applications are not installed on specified managed instances. It can be used to identify the presence of vulnerable applications (prompting removal before they can be exploited) and/or to identify the presence of allowed packages below a minimum version (prompting updates before they can be exploited). The "ec2-managedinstance-platform-check" managed rule verifies that managed instances are running desired platform types, including using a desired version (as opposed to an out-of-date one). Both can reduce instances' attack surface for adversary exploitation, including for privilege escalation.
The "ecs-task-definition-user-for-host-mode-check" managed rule can identify Amazon Elastic Container Service (ECS) task definitions for containers with host networking mode and 'privileged' or 'user' container definitions, which may enable adversaries to break out of containers and gain access to the underlying host, increasing their access and privileges.
All of these are run on configuration changes. Coverage factor is partial for these rules, since they are specific to a subset of the available AWS services and will only protect against certain forms of identifiable exploitation, resulting in an overall score of Partial.
References
|
| aws_security_hub | AWS Security Hub | technique_scores | T1068 | Exploitation for Privilege Escalation |
Comments
AWS Security Hub reports on EC2 instances that are missing security patches for vulnerabilities which could enable an adversary to exploit vulnerabilities through the attack lifecycle. AWS Security Hub provides this detection with the following managed insight.
EC2 instances that have missing security patches for important vulnerabilities
This is scored as Partial because the checks associated with Security Hub would only report on missing patches for known vulnerabilities. It doesn't not cover zero-day vulnerabilities.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| DEF-SECA-E3 | Security Alerts | Technique Scores | T1068 | Exploitation for Privilege Escalation |
Comments
Microsoft Defender security alerts explain the suspicious activities detected by Defender for Identity sensors on your network, and the actors and computers involved in each threat. Alert evidence lists contain direct links to the involved users and computers, to help make your investigations easy and direct.
Defender security alerts are divided into the following categories or phases, like the phases seen in a typical cyber-attack kill chain. Learn more about each phase, the alerts designed to detect each attack, and how to use the alerts to help protect your network using the following links:
Reconnaissance and discovery alerts
Persistence and privilege escalation alerts
Credential access alerts
Lateral movement alerts
Other alerts
License: A Microsoft 365 security product license entitles customer use
of Microsoft Defender XDR.
References
|
| DEF-LM-E5 | Lateral Movements | Technique Scores | T1068 | Exploitation for Privilege Escalation |
Comments
Defender for Identity LMPs are visual guides that help you quickly understand and identify exactly how attackers can move laterally inside your network. The purpose of lateral movements within the cyber-attack kill chain are for attackers to gain and compromise your sensitive accounts using non-sensitive accounts. Compromising your sensitive accounts gets them another step closer to their ultimate goal, domain dominance. To stop these attacks from being successful, Defender for Identity LMPs give you easy to interpret, direct visual guidance on your most vulnerable, sensitive accounts.
References
|