Overview of MITRE ATT&CK Tactic : TA0004 - Privilege Escalation

Introduction

The Privilege Escalation tactic in the MITRE ATT&CK, covers techniques that adversaries use to gain higher-level permissions on compromised systems or networks. After gaining initial access, attackers frequently need elevated rights to access sensitive resources, execute restricted operations, or maintain persistence. Techniques include exploiting OS vulnerabilities, misconfigurations, or weaknesses in security controls to move from user-level to admin or root privileges. This may involve abusing elevation control mechanisms (like sudo, setuid, or UAC), manipulating accounts or tokens, leveraging scheduled tasks, or exploiting valid credentials.

Techniques and Sub-Techniques

T1548 – Abuse Elevation Control Mechanisms 

This technique involves bypassing or abusing OS mechanisms that restrict elevated execution, such as sudo, UAC, or setuid binaries. Here, adversaries exploit misconfigurations or weak rules to run commands with higher privileges. This often requires no exploit code but just permission misuse. Once elevated, attackers gain access to restricted system operations. 

• T1548.001 – Setuid and Setgid

  Here, attackers run the programs with elevated permissions by abusing setuid/setgid bits on Unix systems. This allows execution as another user, often root, without needing the password. 

• T1548.002 – Bypass User Account Control

  Adversaries exploit UAC weaknesses to elevate privileges without user approval.This grants admin-level execution while maintaining user-level stealth. 

• T1548.003 – Sudo and Sudo Caching

  In these mis-configured sudo rules or cached credentials allow attackers to run privileged commands. They escalate without full authentication or bypass intended restrictions. 

• T1548.004 – Elevated Execution with Prompt

  Here, malicious actors deceive users into granting elevated rights to a malicious process. This uses social engineering rather than technical exploitation. 

• Temporary Elevated Cloud Access 

  Cloud platforms issue temporary privileges through roles or tokens. Misconfigured role assumptions or temporary credentials can be abused to obtain short-term high-level access. 

• TCC Manipulation 

  This happens when attackers tamper with macOS’s privacy-control system to wrongfully grant apps access to sensitive resources like the camera, microphone, or full disk. It essentially bypasses user consent protections. 

T1134 - Access Token Manipulation  

Adversaries modify or steal Windows access tokens to make malicious processes run with the permission of another user. By impersonating these tokens, attackers can bypass access controls, escalate privileges, and perform actions as though they are legitimate users or even SYSTEM. 

• Token Impersonation/Theft

  Here attackers duplicate and impersonate another user’s token, allowing their process to operate with the privileges of the legitimate user, this technique is frequently used to gain higher-level privileges on Windows machines. 

• Create Process with Token

  Adversaries use a stolen or duplicated token to spawn a new process under the security context of a higher-privilege user, enabling the execution of actions with elevated permissions.​ 

• Make and Impersonate Token

  Attackers generate new tokens using credentials they possess, then impersonate a target user's identity to gain unauthorized access and escalate their privileges.​ 

• Parent PID Spoofing

  This technique manipulates the parent process ID (PPID) of a new process, so it appears to have a trusted parent, helping adversaries evade defenses or gain higher privileges.​ 

• SID-History Injection 

  Here, adversaries inject SID-History attributes into access tokens or Active Directory to spoof the permissions, this technique enables attackers to sidestep traditional group membership rules, granting them privileges that would normally be restricted. 

T1098 - Account Manipulation  

It refers to actions taken by attackers to preserve their access using compromised accounts, such as modifying credentials, group memberships, or account settings. By changing permissions or adding credentials, adversaries can escalate privileges, maintain persistence, or create hidden backdoors for future access. 

• Additional Cloud Credentials 

  Adversaries add their own keys, passwords, or service principal credentials to victim cloud accounts, enabling escalation without detection. This allows them to use new credentials and bypass standard log or security controls in cloud environments.​ 

• Additional Email Delegate Permissions

  Attackers may grant themselves high-level permissions on email accounts, allowing unauthorized access, control or forwarding of sensitive communications, which can give visibility into victim correspondence for further attacks.​ 

• Additional Cloud Roles

  Adversaries assign new privileged roles to compromised accounts, expanding permissions and enabling wider access to cloud resources.  

• SSH Authorized Keys

  Attackers append or modify their public keys to SSH authorized_keys files on target machines. This technique bypass password authentication and allows undetected logins to compromised systems.​ 

• Device Registration

  Adversaries register malicious devices with victim accounts, often in MFA or management portals to maintain ongoing access. This can allow attackers to access resources as trusted endpoints.​ 

• Additional Container Cluster Roles

  Attackers grant their accounts extra permissions or roles in container orchestration systems such as Kubernetes. These elevated roles allow broader control over cluster resources and enable cluster-wide compromise.​ 

• Additional Local or Domain Groups

  Adversaries add their accounts to privileged local or domain groups, gaining higher-level access and capabilities. This manipulates group memberships for escalation, persistence, and dominance within target environments. 

T1547 – Boot or Logon Autostart Execution 

Attackers abuse programs that automatically run during boot or login. These locations can be modified to launch malicious code with elevated privileges. 
This provides persistence and often higher-level execution. It is commonly achieved by manipulating registry keys, services, or startup folders. 

• Registry Run Keys / Startup Folder: 

  Attackers add malicious programs to Windows Registry run keys or Startup folders to ensure automatic execution when a user logs in. This technique provides persistent and often stealthy privilege escalation on system reboot and login.​ 

• Authentication Package:

  By installing a malicious authentication package (DLL), adversaries can intercept credentials or execute code with system-level privileges during the Windows authentication process, enabling privilege escalation and persistence.​ 

• Time Providers:

  Attackers register malicious DLLs as Windows time providers DLLs responsible for time synchronization so that their code is loaded by system processes on boot or at scheduled intervals, allowing stealthy system-level access and persistence.​ 

• Winlogon Helper DLL:

  Adversaries plant a helper DLL in Winlogon’s registry settings so it loads with each user logon, running malicious code with high privileges and ensuring execution whenever the system starts or a user logs in.​ 

• Security Support Provider:

  Inserting a rogue Security Support Provider (SSP) DLL allows attackers to monitor or manipulate authentication and system logins, potentially capturing credentials and persisting with SYSTEM privileges at the operating system level.​ 

• Kernel Modules and Extensions:

  Attackers load malicious modules or kernel extensions to run arbitrary code in kernel space, giving them unrestricted control over the system, hiding their presence, or manipulating low-level OS behavior for privilege escalation.​ 

• Re-opened Applications:

  On macOS, adversaries abuse property list files that track reopened applications after reboot, ensuring their chosen programs or payloads relaunch automatically and persistently escalate privileges upon user login.​ 

• LSASS Driver:

  Modifying or adding an LSASS (Local Security Authority Subsystem Service) driver gives attackers persistent system-level code execution, potentially accessing or controlling authentication processes.​ 

• Shortcut Modification:

  By altering shortcut files (LNKs), adversaries ensure that opening a benign application or file instead executes attacker-controlled code, effectively leveraging user actions for privilege escalation and persistence.​ 

• Port Monitors:

  Attackers install or hijack port monitoring DLLs, which Windows loads to manage printers, so that their code runs with SYSTEM privileges when the service starts, enabling privilege escalation and persistence.​ 

• Print Processors:

  Planting a malicious print processor DLL, the software Windows uses to handle print jobs causes Windows to execute attacker code as SYSTEM whenever print functions are called, creating a persistence and privilege escalation method.​ 

• XDG Autostart Entries:

  On Linux desktop environments, adversaries use XDG-compliant autostart entries to launch malicious programs automatically at user login, gaining persistent execution and the ability to operate with user or escalated privileges.​ 

• Active Setup:

  Attackers add or modify Active Setup registry keys to ensure their payloads execute with elevated privileges during user profile initialization, such as when a new user logs in.​ 

• Login Items:

  On macOS, adversaries add login items that point to their malicious applications or scripts, guaranteeing code execution with the user’s privileges whenever a login event occurs. 

T1037 - Boot or Logon Initialization Scripts  

It refers to the use of scripts that are automatically executed during system startup or user logon to help adversaries maintain persistence on a machine. By modifying these scripts, attackers can ensure their malicious code runs every time the system boots. 

• Logon Script (Windows): 

  Scripts configured in Windows to run automatically during user or group logon can be exploited by adversaries to execute malicious code with the user’s privileges, enabling persistence or escalation.​ 

• Login Hook: 

  A login hook is an macOS mechanism that allows scripts or executables to run automatically upon a user’s login, which attackers may abuse to achieve persistence or elevate privileges. 

• Network Logon Script:  

  These are scripts assigned via Active Directory or Group Policy to execute during network logon, potentially allowing adversaries to introduce or persist malicious code in a domain environment.​ 

• RC Scripts: 

  On Unix-like systems, RC (run command) scripts control startup processes. Attackers who modify these can ensure their code runs with elevated privileges every time the system boots.​ 

• Startup Items:  

  Files or programs set to launch automatically during boot or user login can be manipulated by attackers, allowing persistent or privileged execution at startup. 

T1543 – Create or Modify System Process 

Attackers modify or create system services or daemons that run with high privileges. 
By altering service configurations, they ensure malicious code executes as SYSTEM/root. This provides long-term persistence and elevated access. 

• Launch Agent: 

  Attackers can create or modify launch agents on macOS to automatically execute malicious payloads whenever a user logs in, helping maintain persistence at the user level.​ 

• Systemd Service: 

  By altering systemd service files on Linux, adversaries can ensure their code runs as a background service during startup, maintaining continuous access to the system.​ 

• Windows Service: 

  Attackers abuse Windows service configurations to install or modify services that launch malicious programs on startup or at defined intervals, allowing persistent and privileged access.​ 

• Launch Daemon: 

  On macOS, launch daemons are set up to run background processes with elevated privileges before user login, often used by attackers to achieve system-wide persistence.​ 

• Container Service:  

  Adversaries may create or modify container or cluster management services (like Docker or Kubernetes agents) to repeatedly execute malicious code inside containers as part of persistence.​ 

T1484 - Domain or Tenant Policy Modification  

Adversaries changing configuration settings in a domain or tenant environment, such as Active Directory or cloud identity services, to bypass security controls and escalate privileges. This can include editing group policy objects, trust relationships, or federation settings, which may impact large numbers of users or systems across an organization. Attackers leverage this technique to gain persistent elevated access and make detection or remediation much more difficult. 

• Group Policy Modification: 

  Attackers may alter Group Policy Objects (GPOs) in Active Directory environments to subvert security settings and gain elevated privileges across the domain. By doing, these attackers can deploy malicious tasks, change user rights or disable security controls on many systems simultaneously.​ 

• Trust Modification: 

  Adversaries change domain or tenant trust relationships, such as adding, removing or altering trust properties between domains or tenants to expand their access and ensure continued control. This can let attackers move laterally, escalate privileges across multiple domains.  

T1611 – Escape to Host 

In virtualized environments, attackers attempt to escape a container or VM. 
If successful, they gain access to the underlying host system, which has higher privileges. This usually arises due to weaknesses in the hypervisor or insufficient separation between virtual environments. Hence, it gives complete control to the attacker over every workload operating on that host. 

T1546 – Event Triggered Execution 

Attackers use system events like service start, scheduled job, user login, etc. to trigger malicious code. These triggers often run with SYSTEM or administrative privileges. 
By hijacking legitimate event handlers, the attacker executes commands without raising suspicion. It also enables persistence tied to normal system operations. 

• Change Default File Association:  

  Attackers alter file type associations so that opening a file triggers malicious code, helping them gain persistence or escalate privileges. 

• Screensaver: 

  Adversaries can replace system screensavers with malicious executables, causing code to run automatically when the screensaver activates. 

• Windows Management Instrumentation Event Subscription:  

  By setting up WMI event subscriptions, attackers ensure their code executes in response to specific system events, establishing stealthy persistence on Windows.​ 

• Unix Shell Configuration Modification:  

  Modifying shell configuration files like .bashrc or.profile allows adversaries to start malicious code whenever a user opens a terminal session. 

• Trap:  

  Attackers abuse shell trap commands to execute code in response to system signals (e.g., shutdown, logoff, or errors), enhancing persistence or privilege escalation. 

• LC_LOAD_DYLIB Addition:  

  By adding malicious the LC_LOAD_DYLIB header to macOS binaries, attackers can force the system to load rogue dynamic libraries during execution. 

• Netsh Helper DLL:  

  Attackers register malicious DLLs as Netsh helpers, ensuring their code loads whenever Netsh is used, aiding persistence or privilege escalation. 

• Accessibility Features:  

  Abusing Windows accessibility tools (like Sticky Keys) lets attackers invoke system shells or backdoors at the login screen, bypassing standard authentication. 

• AppCert DLLs:  

  Adversaries inject DLLs via AppCert DLL Registry keys, so their code runs in every process creation, creating broad persistence. 

• AppInit DLLs:  

  Attackers exploit AppInit DLL Registry values to ensure their DLLs are loaded into multiple processes, maintaining persistence. 

• Application Shimming:  

  By creating or modifying Windows application shims, adversaries force the system to redirect legitimate programs to launch malicious code. 

• Image File Execution Options Injection:  

  Modifying Image File Execution Options (IFEO) in Registry allows attackers to set debuggers that hijack normal application launches for persistence. 

• PowerShell Profile:  

  Malicious code in PowerShell profile scripts will auto-run whenever PowerShell starts, providing persistence and privilege escalation opportunities. 

• Emond:  

  Attackers place malicious rules in macOS’s Emond event monitor daemon, causing code to run in response to system events. 

• Component Object Model Hijacking:  

  By hijacking references to COM objects in Windows, adversaries ensure their code launches when certain applications or system routines are invoked. 

• Installer Packages:  

  Attackers may leverage installer scripts or packages to deploy persistent code during application installation or updates. 

• Udev Rules:  

  By modifying Linux’s udev rules, adversaries configure devices to trigger the execution of rogue code during events like hardware insertion. 

• Python Startup Hooks:  

  Attackers add code to Python startup scripts or modules, causing their payload to run automatically whenever Python interpreter is launched. 

T1068 – Exploitation for Privilege Escalation 

Attackers exploit software or OS vulnerabilities to gain elevated rights. This may target kernel flaws, driver bugs, or misconfigured services. By triggering the vulnerability, adversaries escalate from low-privilege to SYSTEM/root. This is one of the most direct and powerful escalation methods. 

T1574 – Hijack Execution Flow 

This technique alters how the system resolves and launches programs. Attackers place malicious files where high-privilege processes expect legitimate ones. When the privileged process starts, it inadvertently loads or executes the attacker code. This leverages DLL search order hijacking, path hijacking, and similar methods. 

• DLL:  

  Attackers exploit the way Windows applications load Dynamic Link Libraries (DLLs), tricking them into running malicious DLLs for code execution or privilege escalation.​ 

• Dylib Hijacking:  

  Adversaries target macOS by placing malicious dylib files in directories searched by applications, causing them to be loaded instead of legitimate libraries.​ 

• Executable Installer File Permissions Weakness:  

  Attackers leverage weak permissions on installer files to replace or modify executables, allowing unauthorized code execution with high privileges.​ 

• Dynamic Linker Hijacking:  

  This technique manipulates the loading process of shared libraries (DLLs or dylibs), often abusing environment variables (like PATH) or loader settings to ensure malicious libraries are loaded first.​ 

• Path Interception by PATH Environment Variable:  

  Adversaries modify the PATH environment variable, influencing where the system searches for executables and libraries, enabling malicious code to be loaded.​ 

• Path Interception by Search Order Hijacking:  

  Attackers exploit insecure search orders for files or DLLs, placing malicious files in locations that applications check before trusted locations.​ 

• Path Interception by Unquoted Path:  

  By taking advantage of unquoted paths in executable calls, adversaries' plant malicious files that are incorrectly loaded by the system, allowing code execution.​ 

• Services File Permissions Weakness:  

  Weak permissions on Windows service files enable attackers to replace service executables with malicious content, gaining persistent system access.​ 

• Services Registry Permissions Weakness:  

  Adversaries exploit weak registry settings of Windows services, altering keys to redirect service execution to their malicious code.​ 

• COR_PROFILER:  

  Attackers abuse the COR_PROFILER environment variable to hijack the way . NET applications load profiling DLLs, gaining code execution during app runtime.​ 

• KernelCallbackTable:  

  This involves altering callback tables in the Windows kernel to redirect the execution flow, enabling arbitrary code to run with elevated privileges.​ 

• AppDomainManager:  

  By subverting the AppDomainManager in .NET applications, adversaries gain control over the loading of assemblies, potentially executing malicious payloads during application startup. 

T1055 – Process Injection 

This involves injecting malicious code into legitimate processes. Injected processes often run with higher privileges than the attacker initially has. It enables evasion of security tools by blending into trusted processes. Successful injection allows execution under a more privileged security context. 

• Dynamic-link Library Injection:  

  Injects malicious DLLs into live processes to execute unauthorized code in the process memory, enabling attackers to evade defenses and elevate privileges.​ 

• Portable Executable Injection:  

  Loads or maps a malicious executable (EXE) into the address space of another process, running code under the guise of a legitimate application.​ 

• Thread Execution Hijacking:  

  Redirects the execution flow of an active thread in a process to run attacker-controlled code, often used for stealthy payload delivery.​ 

• Asynchronous Procedure Call (APC):  

  Delivers malicious code by queuing attacker-specified functions (APCs) to run in the context of another process or thread.​ 

• Thread Local Storage (TLS):  

  Uses TLS callbacks within a process to execute injected code when the process loads DLLs, often leveraging this for covert malware execution.​ 

• Ptrace System Calls:  

  Exploits ptrace debugging capabilities (on Unix/Linux) to inject and execute malicious code within the address space of a targeted process.​ 

• Proc Memory:  

  Modifies memory structures directly through the /proc filesystem (Linux/Unix) to inject or alter code in running processes for persistence or privilege escalation.​ 

• Extra Window Memory Injection:  

  Injects code into special memory regions (like window memory in Windows GUI processes) to achieve code execution in those processes.​ 

• Process Hollowing:  

  Creates a legitimate process, then swaps its memory with attacker code, making malware run under the mask of valid processes to evade detection.​ 

• Process Doppelgänging:  

  Leverages Windows Transactional NTFS (TxF) and process creation mechanisms to run malicious code in a way that appears legitimate and avoids conventional monitoring.​ 

• VDSO Hijacking:  

  Modifies the Virtual Dynamic Shared Object (VDSO) in Linux to execute injected code during system or process startup routines.​ 

• ListPlanting:  

  Manipulates application or window list memory, using this entrypoint for code injection into legitimate processes without overtly altering their main execution flow. 

T1053 – Scheduled Task/Job 

Attackers create or modify scheduled tasks to run malware with elevated privileges. These jobs often execute under SYSTEM, root, or service accounts. It provides both persistence and privilege escalation. The scheduled execution blends into normal automated system behavior. 

• At:  

  Attackers use the "at" scheduling utility on Windows or Unix-like systems to set up tasks that run at specific times, enabling persistence or timed execution of malicious programs.​ 

• Cron: 

  By adding entries to cron on Unix/Linux systems, adversaries can schedule their malicious code to execute automatically at regular intervals, maintaining access without user interaction.​ 

• Scheduled Task: 

  Threat actors abuse operating system scheduling features (like Windows Task Scheduler) to run unwanted commands or software on startup or according to a set schedule for persistence.​ 

• Systemd Timers:  

  In Linux environments, attackers configure systemd timers to trigger services or executables at designated times, ensuring regular execution of their payloads even after restarts.​ 

• Container Orchestration Job:  

  Adversaries leverage cluster scheduling platforms (such as Kubernetes Cron Jobs) to deploy containers that repeatedly execute malicious code across multiple nodes, providing scalable and automated persistence in cloud-native environments. 

T1078 – Valid Accounts 

Adversaries use stolen credentials to access legitimate user, admin, or service accounts for initial access, persistence, or privilege escalation, often bypassing security controls by blending in with normal activity.​ 

• Default Accounts: 

  These are pre-configured accounts built into operating systems or applications, such as guest or administrator; attackers exploit weak, unchanged, or known passwords on these accounts to gain unauthorized access.​ 

• Domain Accounts:  

  Managed by Active Directory, domain accounts allow users, administrators, or services to access resources across an organization’s network; adversaries leverage compromised domain credentials for lateral movement or privileged actions.​ 

• Local Accounts:  

  Accounts specific to a single machine or device, often with administrative privileges; attackers use compromised local credentials to escalate rights or maintain control over endpoints.​ 

• Cloud Accounts: 

  These are accounts for cloud platforms or services (like AWS, Azure, GCP); Those adversaries who obtain these credentials can gain significant control, escalate privileges, or persist in cloud environments. 

How F5 can help?  

F5 security solutions, including BIG-IP, NGINX, and Distributed Cloud, provide robust defenses against privilege escalation risks by enforcing strict access controls, role-based permissions, and session validation. These protections mitigate risks from vulnerabilities and misconfigurations that adversaries exploit to elevate privileges. F5’s security capabilities also offer monitoring and threat detection mechanisms that help identify anomalous activities indicative of privilege escalation attempts.  

For more information, please contact your local F5 sales team.

Conclusion

Privilege escalation is a critical cyberattack tactic that allows attackers to move from limited access to elevated permissions, often as administrator or root on compromised systems. This expanded control lets attackers disable security measures, steal sensitive data, persist in the environment, and launch more damaging attacks. Preventing and detecting privilege escalation requires layered defenses, vigilant access management, and regular security monitoring to minimize risk and respond quickly to unauthorized privilege gains.

Reference Links: 

• MITRE ATT&CK®
• Privilege Escalation, Tactic TA0004 - Enterprise | MITRE ATT&CK® 
• MITRE ATT&CK: What It Is, How it Works, Who Uses It and Why | F5 Labs