What is Privilege Escalation?

Escalation splits into two forms with different investigative signatures. Vertical escalation gains a fundamentally higher privilege level, for example a standard user exploiting an unpatched kernel vulnerability to obtain local administrator rights, or a local admin using Kerberoasting to crack a service account's password offline and pivot to domain admin. Horizontal escalation stays at the same nominal privilege tier but reaches into another account's resources, such as reading a coworker's files or hijacking their active session, which matters less for raw power and more for scope and stealth.

Common techniques an analyst should recognize by their artifacts: unpatched local vulnerabilities (kernel exploits, unquoted service paths that let an attacker plant an executable in a directory Windows will run with SYSTEM privileges), misconfigured services (a service running as SYSTEM but with a writable executable path or DLL search order an attacker can hijack), credential theft from memory (LSASS process dumping via Mimikatz or built-in tools like comsvcs.dll, extracting cached plaintext passwords, NTLM hashes, and Kerberos tickets), Kerberoasting (requesting a service ticket for any account with a registered SPN and cracking it offline, since service account passwords are frequently old and weak), and group membership abuse (an attacker with sufficient access simply adding a controlled account to Domain Admins or a similarly privileged group).

Windows and Active Directory environments have a particularly rich escalation surface because of how service accounts, SPNs, and delegation are configured by default, which is why tools like BloodHound exist specifically to map escalation paths an attacker, or a defender doing the same analysis, could walk from a low-privileged foothold to domain admin. Linux escalation more often runs through sudo misconfigurations, SUID binaries, or kernel exploits, while cloud environments such as AWS, Azure, and GCP have their own escalation surface built on overly permissive IAM roles and misconfigured trust policies.

Controls that meaningfully reduce this surface include privileged access management solutions that vault and rotate credentials rather than leaving them static, regular privilege audits that catch accumulated unnecessary access, just-in-time elevation instead of standing admin rights, and endpoint protection tuned specifically to detect credential-theft techniques like anomalous LSASS access patterns rather than relying on generic malware signatures.