Identity & Access

Privilege Escalation

Low-privilege access becomes administrative control through misconfigured roles and credentials in memory.

What it is

Once inside, attackers escalate from a standard user account to administrative or domain-level privilege. This occurs through Kerberoasting (extracting and cracking service account password hashes), pass-the-hash, exploiting over-permissioned local accounts, or abusing group policy and ACL misconfigurations in Active Directory.

Attack techniques

Kerberoasting (T1558.003)
Pass-the-Hash (T1550.002)
AS-REP Roasting (T1558.004)
Token Impersonation (T1134)
Abuse of GPO/ACL (T1484)
Local Privilege Escalation via unpatched CVEs

Business impact

Administrative or domain-level privilege gives an attacker the ability to create accounts, disable logging, deploy ransomware, or extract the entire Active Directory credential database.

Authoritative references

MITRE ATT&CK — Privilege Escalation (TA0004)
MITRE ATT&CK — Kerberoasting (T1558.003)
CIS Controls — Privileged Access Management
NSA — Detecting Abuse of Authentication Mechanisms

← Back to Identity & Access Design an engagement →