What is Privilege Escalation?
Privilege escalation is how an attacker gains higher access rights than initially obtained: standard user to administrator, local admin to domain admin, or a low-privileged process to SYSTEM, enabling broader access and control.
Definition
- Privilege Escalation
- Privilege escalation is how an attacker gains higher access rights than initially obtained: standard user to administrator, local admin to domain admin, or a low-privileged process to SYSTEM, enabling broader access and control.
How Privilege Escalation Works
Two forms. Vertical escalation: gaining higher-privilege access (standard user exploiting a kernel vulnerability for local admin, local admin exploiting Kerberoasting for domain admin). Horizontal escalation: accessing other accounts at the same privilege level (reading another user's files or session).
Common techniques: unpatched local vulnerabilities (kernel exploits, unquoted service paths), misconfigured services (writable service executables, DLL hijacking), credential theft from memory (LSASS dumping via Mimikatz), Kerberoasting (offline cracking of service account hashes), and group membership abuse (adding accounts to privileged groups).
Controls include PAM solutions, regular privilege audits, just-in-time access, and endpoint protection detecting credential theft techniques. Monitoring for privileged group membership changes and unusual admin tool usage provides high-fidelity detection.
Privilege Escalation in SOC Operations
Privilege escalation alerts are high-priority because the attacker is actively expanding capabilities. Key signals: processes accessing LSASS memory, new members added to Domain Admins, unusual Mimikatz or ProcDump usage, service account modifications. Move fast when you see these. In experienced attacker campaigns, domain admin compromise typically follows privilege escalation within minutes.
Practice Privilege Escalation in a Real SOC
SOCSimulator provides hands-on training with realistic SIEM, XDR, and Firewall interfaces. Build real analyst skills investigating privilege escalation scenarios with zero consequences — free forever.
Related Terms
Lateral movement is the attack phase where adversaries expand access from an initial foothold to add...
Persistence refers to techniques adversaries use to maintain access across reboots, credential chang...
The principle of least privilege states that users, processes, and systems should receive only the m...
Endpoint Detection and Response (EDR) is a security technology that continuously monitors endpoint a...
User and Entity Behavior Analytics (UEBA) applies machine learning and statistical modeling to estab...
More Threats Terms
Related SOC Training Resources
Threat Hunter Career Guide — Salary & Skills
Threat Hunters do not wait for alerts. You develop hypotheses based on threat intelligence and adversary behavior models…
Read more Career PathIncident Responder Career Guide — Salary & Skills
Incident Responders lead the technical response when confirmed breaches happen. You coordinate containment, run forensic…
Read more Career PathSOC Analyst (Tier 2) Career Guide — Salary & Skills
Tier 2 SOC Analysts handle the investigations that Tier 1 escalates. You dig into multi-stage attacks, coordinate contai…
Read more ComparisonSOCSimulator vs Hack The Box — Comparison
Different tools for different career paths. SOCSimulator trains defensive analysts. Hack The Box trains offensive securi…
Read more ComparisonSOCSimulator vs TryHackMe — Comparison
SOCSimulator is the better tool for dedicated SOC analyst preparation. TryHackMe is the better tool for broad cybersecur…
Read more ToolXDR Training Console — SOCSimulator
The XDR console in SOCSimulator replicates the investigation workflow of platforms like CrowdStrike Falcon, Microsoft De…
Read more ToolSIEM Training Console — SOCSimulator
The SIEM console in SOCSimulator replicates the workflow of enterprise platforms like Splunk Enterprise Security, Micros…
Read more TechniqueMITRE ATT&CK Techniques — Detection Training Library
Browse all MITRE ATT&CK techniques with detection strategies and example alerts.
Read more Career PathCybersecurity Career Paths — 2026 Guide
Explore SOC analyst career paths with salary data, required skills, and certification roadmaps.
Read more PlaybookSOC Investigation Playbooks — Step-by-Step Guides
Practitioner investigation playbooks with decision trees and real SIEM queries.
Read more FeatureShift Mode — Real-Time SOC Simulation
Practice alert triage under realistic time pressure with SLA timers and noise injection.
Read more FeatureOperations — Guided Training Rooms
Structured CTF-style investigation rooms covering real-world attack scenarios.
Read more