Privilege escalation
Also: Elevation of privilege · Privesc
Moving from the narrow access an intrusion first obtains to the administrative or root access that makes everything after it possible.
Initial access is rarely worth much on its own. The account a flaw hands over is usually a service account with narrow rights, while the work that follows — reading stored credentials, changing files that survive a reboot, reaching other machines — needs more. Privilege escalation is that second step, and it is where a nuisance becomes an incident.
What it looks like in practice
In the BeyondTrust Remote Support intrusions the attacker reached root from the web service account by enabling Set User ID permissions. Mandiant described the result as access to every credential the appliance stored or brokered, and the ability to modify files that survive reboot and configuration reset.
The route upward is often a product's own defensive machinery. ShieldBreak turned Microsoft Defender into a way up, which is the pattern worth noting: the component with the most privilege on a host is frequently the one installed to protect it.
Why it sets the blast radius
Severity is scored per flaw, but damage is decided by what the attacker reached afterwards. A medium-severity bug chained to an escalation can be worth more to an intruder than a critical one that stops at a restricted account.
Questions
- What does privilege escalation mean?
- Moving from the limited access gained at first to higher rights, typically administrator or root. It is the step that turns a foothold into control of the host.
- Why does it matter more than the severity score?
- Because the score describes one flaw while the damage depends on what was reached afterwards. A medium-severity bug chained to an escalation can be worse than a critical one that stops at a sandboxed account.