Privilege Escalation

Jump to: navigation, search

Tactic Description

Privilege escalation is the result of actions that allow an adversary to obtain a higher level of permissions on a system or network. Certain tools or actions require a higher level of privilege to work and are likely necessary at many points throughout an operation. Adversaries can enter a system with unprivileged access and must take advantage of a system weakness to obtain local administrator or SYSTEM privileges. A user account with administrator-like access can also be used. User accounts with permissions to access specific systems or perform specific functions necessary for adversaries to achieve their objective may also be considered an escalation of privilege.


Below is a list of all the Privilege Escalation techniques in ATT&CK:

NameTacticsTechnical Description
Accessibility FeaturesPersistence
Privilege Escalation
Windows contains accessibility features that may be launched with a key combination before a user has logged in (for example, when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.

Two of these accessibility programs are C:\Windows\System32\utilman.exe, launched when the Windows + U key combination is pressed, and C:\Windows\System32\sethc.exe, launched when the shift key is pressed five times. The program "sethc.exe" is often referred to as sticky keys, and has been used by adversaries for unauthenticated access through a remote desktop login screen.1

Depending on the version of Windows, an adversary may take advantage of these features in different ways:

On Windows XP and Windows Server 2003/R2, the program (e.g., C:\Windows\System32\utilman.exe) may be replaced with "cmd.exe" (or another program that provides backdoor access). Subsequently, pressing the appropriate key combination at the login screen while sitting at the keyboard or when connected over Remote Desktop Protocol will cause the replaced file to be executed with SYSTEM privileges.2

On Windows Vista and later as well as Windows Server 2008 and later, a Registry key may be modified that configures "cmd.exe," or another program that provides backdoor access, as a "debugger" for the accessibility program (e.g., "utilman.exe"). After the Registry is modified, pressing the appropriate key combination at the login screen while at the keyboard or when connected with RDP will cause the "debugger" program to be executed with SYSTEM privileges.2
AppInit DLLsPersistence
Privilege Escalation
DLLs that are specified in the AppInit_DLLs value in the Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program. This value can be abused to obtain persistence by causing a DLL to be loaded into most processes on the computer.3 The AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled.4
Bypass User Account ControlDefense Evasion
Privilege Escalation
Windows User Account Control (UAC) allows a program to elevate its privileges to perform a task under administrator-level permissions by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.5

If the UAC protection level of a computer is set to anything but the highest level, certain Windows programs are allowed to elevate privileges or execute some elevated COM objects without prompting the user through the UAC notification box.67 An example of this is use of rundll32.exe to load a specifically crafted DLL which loads an auto-elevated COM object and performs a file operation in a protected directory which would typically require elevated access. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user.8 Adversaries can use these techniques to elevate privileges to administrator if the target process is unprotected.

Many methods have been discovered to bypass UAC. The Github readme page for UACMe contains an extensive list of methods9 that have been discovered and implemented within UACMe, but this is not a comprehensive list of published bypasses due to the UACMe project being discontinued in 2016. Additional methods have been discovered and are being used in the wild, such as using eventvwr.exe to auto-elevate and execute a specified binary or script.1011

Another bypass is possible through some Lateral Movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on lateral systems and default to high integrity.12
DLL InjectionDefense Evasion
Privilege Escalation
DLL injection is used to run code in the context of another process by causing the other process to load and execute code. Running code in the context of another process provides adversaries many benefits, such as access to the process's memory and permissions. It also allows adversaries to mask their actions under a legitimate process. A more sophisticated kind of DLL injection, reflective DLL injection, loads code without calling the normal Windows API calls, potentially bypassing DLL load monitoring. Numerous methods of DLL injection exist on Windows, including modifying the Registry, creating remote threads, Windows hooking APIs, and DLL pre-loading.1314
DLL Search Order HijackingDefense Evasion
Privilege Escalation
Windows systems use a common method to look for required DLLs to load into a program.15 Adversaries may take advantage of the Windows DLL search order and programs that ambiguously specify DLLs to gain privilege escalation and persistence.

Adversaries may perform DLL preloading, also called binary planting attacks,16 by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL. Often this location is the current working directory of the program. Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL.17 Adversaries may use this behavior to cause the program to load a malicious DLL.

Adversaries may also directly modify the way a program loads DLLs by replacing an existing DLL or modifying a .manifest or .local redirection file, directory, or junction to cause the program to load a different DLL to maintain persistence or privilege escalation.181920

If a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program.

Programs that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace.
Exploitation of VulnerabilityCredential Access
Defense Evasion
Lateral Movement
Privilege Escalation
Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Exploiting software vulnerabilities may allow adversaries to run a command or binary on a remote system for lateral movement, escalate a current process to a higher privilege level, or bypass security mechanisms. Exploits may also allow an adversary access to privileged accounts and credentials. One example of this is MS14-068, which can be used to forge Kerberos tickets using domain user permissions.2122
File System Permissions WeaknessPersistence
Privilege Escalation
Processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.

Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence.


Manipulation of Windows service binaries is one variation of this technique. Adversaries may replace a legitimate service executable with their own executable to gain persistence and/or privilege escalation to SYSTEM. Once the service is started, either directly by the user (requiring administrator privileges) or through some other means, such as a system restart if the service starts on bootup, the replaced executable will run instead of the original service executable.
Legitimate CredentialsDefense Evasion
Privilege Escalation
Adversaries may steal the credentials of a specific user or service account using Credential Access techniques. Compromised credentials may be used to bypass access controls placed on various resources on hosts and within the network and may even be used for persistent access to remote systems. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence. The overlap of credentials and permissions across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.23
Local Port MonitorPersistence
Privilege Escalation
A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.24 This DLL must be located in C:\Windows\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot.25 Adversaries can use this technique to load malicious code at startup that will persist on system reboot. This same functionality is achieved by creating specifically formatted Registry keys at HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors.25
New ServicePersistence
Privilege Escalation
When operating systems boot up, they can start programs or applications called services that perform background system functions.26 A service's configuration information, including the file path to the service's executable, is stored in the Windows Registry. Adversaries may install a new service that can be configured to execute at startup by using utilities to interact with services or by directly modifying the Registry. The service name may be disguised by using a name from a related operating system or benign software with Masquerading. Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges from administrator to SYSTEM. Adversaries may also directly start services through Service Execution.
Path InterceptionPersistence
Privilege Escalation
Path interception occurs when an executable is placed in a specific path so that it is executed by an application instead of the intended target. One example of this was the use of a copy of cmd in the current working directory of a vulnerable application that loads a CMD or BAT file with the CreateProcess function.27

There are multiple distinct weaknesses or misconfigurations that adversaries may take advantage of when performing path interception: unquoted paths, path environment variable misconfigurations, and search order hijacking. The first vulnerability deals with full program paths, while the second and third occur when program paths are not specified. These techniques can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process.

Unquoted Paths

Service paths (stored in Windows Registry keys)28 and shortcut paths are vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., C:\unsafe path with space\program.exe vs. "C:\safe path with space\program.exe").29 An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is C:\program files\myapp.exe, an adversary may create a program at C:\program.exe that will be run instead of the intended program.

PATH Environment Variable Misconfiguration

The PATH environment variable contains a list of directories. Certain methods of executing a program (namely using cmd.exe or the command-line) rely solely on the PATH environment variable to determine the locations that are searched for a program when the path for the program is not given. If any directories are listed in the PATH environment variable before the Windows directory, %SystemRoot%\system32 (e.g., C:\Windows\system32), a program may be placed in the preceding directory that is named the same as a Windows program (such as cmd, PowerShell, or Python), which will be executed when that command is executed from a script or command-line.

For example, if C:\example path precedes C:\Windows\system32 is in the PATH environment variable, a program that is named net.exe and placed in C:\example path will be called instead of the Windows system "net" when "net" is executed from the command-line.

Search Order Hijacking

Search order hijacking occurs when an adversary abuses the order in which Windows searches for programs that are not given a path. The search order differs depending on the method that is used to execute the program.303132 However, it is common for Windows to search in the directory of the initiating program before searching through the Windows system directory. An adversary who finds a program vulnerable to search order hijacking (i.e., a program that does not specify the path to an executable) may take advantage of this vulnerability by creating a program named after the improperly specified program and placing it within the initiating program's directory.

For example, "example.exe" runs "cmd.exe" with the command-line argument net user. An adversary may place a program called "net.exe" within the same directory as example.exe, "net.exe" will be run instead of the Windows system utility net. In addition, if an adversary places a program called "" in the same directory as "net.exe", then cmd.exe /C net user will execute "" instead of "net.exe" due to the order of executable extensions defined under PATHEXT.33

Search order hijacking is also a common practice for hijacking DLL loads and is covered in DLL Search Order Hijacking.
Scheduled TaskExecution
Privilege Escalation
Utilities such as at and schtasks, along with the Windows Task Scheduler, can be used to schedule programs or scripts to be executed at a date and time. The account used to create the task must be in the Administrators group on the local system. A task can also be scheduled on a remote system, provided the proper authentication is met to use RPC and file and printer sharing is turned on.34 An adversary may use task scheduling to execute programs at system startup or on a scheduled basis for persistence, to conduct remote Execution as part of Lateral Movement, to gain SYSTEM privileges, or to run a process under the context of a specified account.
Service Registry Permissions WeaknessPersistence
Privilege Escalation
If the permissions for users and groups to access the binPath/ImagePath Registry value for a service are not properly secured, adversaries can change the path to point to a different executable under their control. When the service starts or is restarted, then the adversary-controlled program will execute.
Web ShellPersistence
Privilege Escalation
A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to use the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server. In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (see, for example, China Chopper Web shell client).35 Web shells may serve as Redundant Access or as a persistence mechanism in case an adversary's primary access methods are detected and removed.


  1. ^  Glyer, C., Kazanciyan, R. (2012, August 20). THE “HIKIT” ROOTKIT: ADVANCED AND PERSISTENT ATTACK TECHNIQUES (PART 1). Retrieved June 6, 2016.
  2. a b  Tilbury, C. (2014, August 28). Registry Analysis with CrowdResponse. Retrieved November 12, 2014.
  3. ^  Microsoft. (2006, October). Working with the AppInit_DLLs registry value. Retrieved July 15, 2015.
  4. ^  Microsoft. (n.d.). AppInit DLLs and Secure Boot. Retrieved July 15, 2015.
  5. ^  Lich, B. (2016, May 31). How User Account Control Works. Retrieved June 3, 2016.
  6. ^  Russinovich, M. (2009, July). User Account Control: Inside Windows 7 User Account Control. Retrieved July 26, 2016.
  7. ^  Microsoft. (n.d.). The COM Elevation Moniker. Retrieved July 26, 2016.
  8. ^  Davidson, L. (n.d.). Windows 7 UAC whitelist. Retrieved November 12, 2014.
  9. ^  UACME Project. (2016, June 16). UACMe. Retrieved July 26, 2016.
  10. ^  Nelson, M. (2016, August 15). "Fileless" UAC Bypass using eventvwr.exe and Registry Hijacking. Retrieved December 27, 2016.
  11. ^  Salvio, J., Joven, R. (2016, December 16). Malicious Macro Bypasses UAC to Elevate Privilege for Fareit Malware. Retrieved December 27, 2016.
  12. ^  Medin, T. (2013, August 8). PsExec UAC Bypass. Retrieved June 3, 2016.
  13. ^  Kuster, R. (2003, August 20). Three Ways to Inject Your Code into Another Process. Retrieved November 12, 2014.
  14. ^  DLL injection. (n.d.). Retrieved November 12, 2014.
  15. ^  Microsoft. (n.d.). Dynamic-Link Library Search Order. Retrieved November 30, 2014.
  16. ^  OWASP. (2013, January 30). Binary planting. Retrieved June 7, 2016.
  17. ^  Microsoft. (2010, August 22). Microsoft Security Advisory 2269637 Released. Retrieved December 5, 2014.
  18. ^  Microsoft. (n.d.). Dynamic-Link Library Redirection. Retrieved December 5, 2014.
  19. ^  Microsoft. (n.d.). Manifests. Retrieved December 5, 2014.
  20. ^  Mandiant. (2010, August 31). DLL Search Order Hijacking Revisited. Retrieved December 5, 2014.
  21. ^  Microsoft. (2014, November 18). Vulnerability in Kerberos Could Allow Elevation of Privilege (3011780). Retrieved December 23, 2015.
  22. ^  Metcalf, S. (2015, May 03). Detecting Forged Kerberos Ticket (Golden Ticket & Silver Ticket) Use in Active Directory. Retrieved December 23, 2015.
  23. ^  Microsoft. (2016, April 15). Attractive Accounts for Credential Theft. Retrieved June 3, 2016.
  24. ^  Microsoft. (n.d.). AddMonitor function. Retrieved November 12, 2014.
  25. a b  Bloxham, B. (n.d.). Getting Windows to Play with Itself [PowerPoint slides]. Retrieved November 12, 2014.
  26. ^  Microsoft. (n.d.). Services. Retrieved June 7, 2016.
  27. ^  Nagaraju, S. (2014, April 8). MS14-019 – Fixing a binary hijacking via .cmd or .bat file. Retrieved July 25, 2016.
  28. ^  Microsoft. (n.d.). CurrentControlSet\Services Subkey Entries. Retrieved November 30, 2014.
  29. ^  Baggett, M. (2012, November 8). Help eliminate unquoted path vulnerabilities. Retrieved December 4, 2014.
  30. ^  Microsoft. (n.d.). CreateProcess function. Retrieved December 5, 2014.
  31. ^  Hill, T. (n.d.). Windows NT Command Shell. Retrieved December 5, 2014.
  32. ^  Microsoft. (n.d.). WinExec function. Retrieved December 5, 2014.
  33. ^  Microsoft. (n.d.). Environment Property. Retrieved July 27, 2016.
  34. ^  Microsoft. (2005, January 21). Task Scheduler and security. Retrieved June 8, 2016.
  35. ^  Lee, T., Hanzlik, D., Ahl, I. (2013, August 7). Breaking Down the China Chopper Web Shell - Part I. Retrieved March 27, 2015.