Privilege Escalation
What is Privilege Escalation?
The act of exploiting a vulnerability, design flaw, or configuration oversight to gain elevated access to resources that are normally protected from an application or user. Can be vertical (gaining higher privileges) or horizontal (accessing other users' resources).
Terms that appear alongside privilege escalation
Each of these is named in at least one of the same controls as privilege escalation. The number is how many controls name both.
- lateral movement 4 shared controls
- authentication 3 shared controls
- separation of duties 2 shared controls
- audit 2 shared controls
- access control 2 shared controls
- authorization 2 shared controls
- purple team 2 shared controls
- reconnaissance 2 shared controls
Frameworks that govern privilege escalation
What the standards actually require on privilege escalation
Requirements naming privilege escalation across 6 standards, quoted from the control text.
HKMA C-RAF iCAST (Intelligence-led Cyber Attack Simulation Testing) - mandatory for HIGH inherent risk AIs + optional for medium tier + modeled on UK CBEST + ECB TIBER-EU (verified separately in this corpus) + intelligence-led red team testing methodology.
HKMA-CRAF-iCAST-RedTeam-PurpleTeam-IntelLed · HKMA C-RAF iCAST (Intelligence-Led Cyber Attack Simulation Testing) for HIGH Inherent Risk AIs →UR E27 requires equipment manufacturers to deliver CBS with logging + forensic readiness capabilities aligned with IEC 62443-4-2 CR 2.8-2.12 (Auditable events) + FR 6 (Timely Response to Events).
IACS-UR-E27-Logging-Forensics-EventCapture · IACS UR E27 - Equipment Logging + Forensic Readiness + Event Capture + Tamper Detection →X.805 Clause 8 defines 5 Threat Categories that the X.805 Security Architecture is designed to mitigate + provides a Threat-Dimension Countermeasure Matrix linking each threat to specific Dimensions.
X805-Threats-Destruction-Corruption-Removal-Disclosure-Interruption-72Cell-Matrix-Application · ITU-T X.805 5 Threat Categories - Destruction + Corruption + Removal + Disclosure + Interruption + Threat-Dimension Countermeasure Matrix + 72-Cell Matrix Application + STRIDE + MITRE ATT and CK + Network Modular Risk Assessment →Disclose and operate authentication and authorization features per MDS2 PAUT + NAUT + AUTH sections. Person Authentication (PAUT) including user identification + password complexity + MFA support + biometric authentication + smart-card support + LDAP/Active Di...
MDS2-Person-Node-Authentication-Authorization-Auto-Logoff-AUTH-PAUT-NAUT · MDS2 Authentication + Authorization + Auto Logoff + PAUT + NAUT + AUTH + Identity Management →Apply the 14 Enterprise Tactics representing the adversary tactical goals during cyberattack phases (kill chain). TA0043 Reconnaissance - gathering information for planning future operations.
MITRE-ATTACK-Tactics-14-Enterprise-Kill-Chain-Reconnaissance-Initial-Access-Discovery-Lateral-Movement-Impact · MITRE ATT&CK 14 Enterprise Tactics + Reconnaissance + Initial Access + Discovery + Lateral Movement + Impact →Apply Section 5 target vulnerability validation including: password cracking (offline against captured hashes per RoE + John the Ripper + Hashcat + dictionary attacks + rainbow tables) + penetration testing (Sections 5.2 + 5.3 covering planning + discovery + a...
NISTSP115-4 · Target Vulnerability Validation - Password Cracking, Pen Testing, Social Engineering →Questions people ask about privilege escalation
What is Privilege Escalation?
Why is Privilege Escalation important for compliance?
Which compliance frameworks address Privilege Escalation?
Where can I learn more about Privilege Escalation?
See how Privilege Escalation applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.