Privilege escalation
privesc · elevation of privilege · EoP · vertical escalation · horizontal escalation
The stage of an attack where an intruder who got in with limited rights obtains higher ones, up to administrator level.
In practice
Initial access (an employee’s laptop, a web account) rarely gives everything. The attacker then looks for leverage: an unpatched system flaw, a misconfigured service, an administrator password stored in plain text, excessive rights left over from the past. Vertical escalation means becoming an administrator; horizontal escalation means taking over another user account at the same level. Once domain administrator, the attacker can switch off protections and deploy ransomware everywhere.
The Zerologon flaw (CVE-2020-1472), fixed by Microsoft on 11 August 2020, allowed an attacker on the internal network to take control of Active Directory domain controllers. Exploit code was published in September 2020 and CERT-FR issued an alert, as the flaw was being actively exploited.
How to protect yourself
- Apply least privilege: no administrator rights on workstations, and admin accounts separate from everyday email accounts.
- Patch privilege escalation flaws first, especially on domain controllers.
- Protect administrator accounts with a privileged access bastion (PAM) and MFA.
- Monitor additions to admin groups and new account creation.
