Privilege Escalation
Privilege Escalation
Rechteausweitung
Privilege escalation denotes the expansion of one's own rights on a system beyond what was originally permitted — from a simple user to an administrator. It is a central intermediate step of many attacks: only with elevated rights can protective measures be disabled, data captured comprehensively and persistence established. It turns a small foot in the door into full control.
History & facts. A distinction is made between vertical escalation (more rights than before, such as becoming an administrator) and horizontal escalation (access to the resources of another user at the same level). Routes there are exploitable vulnerabilities, misconfigurations, excessively granted rights or captured credentials. In the course of an attack it typically follows initial access and paves the way to lateral movement and the actual objective — a phase that Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) explicitly identifies.
Outlook & recommendation. The strongest prevention is the principle of least privilege: those who may do only what is necessary from the outset offer less leverage. Added to this are prompt patching, avoiding misconfigurations, separating administrative and everyday accounts and securing privileged access with Multi-Factor Authentication (MFA). On the detection side, sudden rights changes, unusual administrative activity or new privileged accounts are clear alarm signals for central analysis.