Privilege Escalation
What is Privilege Escalation?
The act of exploiting a vulnerability, design flaw, or configuration oversight to gain elevated access to resources that are normally protected from an application or user. Can be vertical (gaining higher privileges) or horizontal (accessing other users' resources).
Terms that appear alongside privilege escalation
Each of these is named in at least one of the same controls as privilege escalation. The number is how many controls name both.
- lateral movement 4 shared controls
- authentication 3 shared controls
- separation of duties 2 shared controls
- audit 2 shared controls
- access control 2 shared controls
- authorization 2 shared controls
- purple team 2 shared controls
- reconnaissance 2 shared controls
Frameworks that govern privilege escalation
What the standards actually require on privilege escalation
Requirements naming privilege escalation across 6 standards, quoted from the control text.
The institution identifies the key business and support functions whose failure would create material operational or reputational risk, significant financial loss or harm to Hong Kong's financial stability, the critical services or systems under each with thei...
hkma-cyber-resilience-assessment-framework-c-raf::ICAST.3 · iCAST scoping: key functions, critical systems and test goals →X.805 Clause 8 defines 5 Threat Categories that the X.805 Security Architecture is designed to mitigate + provides a Threat-Dimension Countermeasure Matrix linking each threat to specific Dimensions.
X805-Threats-Destruction-Corruption-Removal-Disclosure-Interruption-72Cell-Matrix-Application · ITU-T X.805 5 Threat Categories - Destruction + Corruption + Removal + Disclosure + Interruption + Threat-Dimension Countermeasure Matrix + 72-Cell Matrix Application + STRIDE + MITRE ATT and CK + Network Modular Risk Assessment →Apply the 14 Enterprise Tactics representing the adversary tactical goals during cyberattack phases (kill chain). TA0043 Reconnaissance - gathering information for planning future operations.
MITRE-ATTACK-Tactics-14-Enterprise-Kill-Chain-Reconnaissance-Initial-Access-Discovery-Lateral-Movement-Impact · MITRE ATT&CK 14 Enterprise Tactics + Reconnaissance + Initial Access + Discovery + Lateral Movement + Impact →The FI should establish a security operations centre or acquire managed security services, with defined processes and roles, for continuous monitoring of cyber events (exploits, intrusions, privilege escalation, unauthorised access, exfiltration, command-and-c...
monetary-authority-of-singapore-technology-risk-management-guidelines::12.2 · 12.2 Cyber Event Monitoring and Detection →Apply Section 5 target vulnerability validation including: password cracking (offline against captured hashes per RoE + John the Ripper + Hashcat + dictionary attacks + rainbow tables) + penetration testing (Sections 5.2 + 5.3 covering planning + discovery + a...
NISTSP115-4 · Target Vulnerability Validation - Password Cracking, Pen Testing, Social Engineering →Monitor malware per Section 4.4 including signature-based AV + behavioral EDR + sandboxing + threat intel feed integration + Indicators of Compromise (IOCs) + Indicators of Attack (IOAs).
NISTSP137-6 · Malware, Identity Access, and Network Boundary Monitoring →Questions people ask about privilege escalation
What is Privilege Escalation?
Why is Privilege Escalation important for compliance?
Which compliance frameworks address Privilege Escalation?
Where can I learn more about Privilege Escalation?
See how Privilege Escalation applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.