Privilege Escalation: Windows and Linux Techniques, Detection and Prevention

Privilege escalation, which Microsoft calls elevation of privilege, is the step where an attacker who already has a foothold (a standard user account, a web server process taken over through remote code execution, a container) gains more permissions than they were given: local administrator or SYSTEM on Windows, root on Linux, Domain Admin in Active Directory, or an admin role in the cloud. It is rarely how an intrusion starts, but it is how a contained incident becomes a breach, because dumping credentials from memory, disabling security tools and pushing ransomware across a network all need elevated rights. Most escalation paths in real networks come from configuration rather than zero-days, so most can be found and closed before an attacker uses them.

To have the paths in your network found and proven, our internal network penetration testing starts at $6,000 (see internal network testing prices), and the Active Directory security assessment tests one domain from one standard user for the same price.

Vertical vs horizontal privilege escalation

Vertical escalation is gaining a higher level of access: a user becomes an administrator, a service account becomes SYSTEM. It is what most people mean, and what this page covers for hosts, domains and cloud accounts. Horizontal escalation is reaching another account’s access at the same level, such as one customer reading another’s invoices. In web applications it usually comes from broken authorization like an IDOR vulnerability. Applications have vertical escalation too, when a regular user reaches admin functions because the server never checks the role; web application penetration testing covers both kinds.

Vertical escalation happens at three levels: on a host (user to administrator, SYSTEM or root), in the domain (any user to Domain Admin), and in the cloud (a role or key to account or tenant admin). macOS is out of scope for this page.

Where privilege escalation sits in an attack

MITRE ATT&CK tracks it as tactic TA0004, an adversary “trying to gain higher-level permissions.” ATT&CK v20 lists 13 techniques under it, including Exploitation for Privilege Escalation (T1068), Valid Accounts (T1078) and Escape to Host (T1611). Two techniques cited below, Hijack Execution Flow (T1574) and Unsecured Credentials (T1552), sit under other ATT&CK tactics. In a real intrusion, escalation alternates with credential theft and lateral movement: escalate on one host, take the credentials cached there, move, escalate again, until one of those credentials controls the domain. Our guide to how ransomware attacks work shows the whole chain.

A privilege escalation attack example

In April 2025, Microsoft reported that a group it tracks as Storm-2460 used CVE-2025-29824, a zero-day in the Windows Common Log File System driver, to go from a standard user to SYSTEM. The operators then dumped LSASS memory for credentials and encrypted files with ransomware whose note Microsoft tied to RansomEXX. The patch shipped April 8, 2025; Windows 11 24H2 was not affected by the observed exploitation, thanks to a hardening change.

Of the 1,769 entries in CISA’s Known Exploited Vulnerabilities catalog on November 6, 2026, at least 152 have names that identify them as privilege escalation or elevation-of-privilege flaws (our count; 122 in Microsoft products), and CISA marks 53 of those as used in ransomware campaigns. The count matches on the catalog’s vulnerability name field only, so it is a floor: flaws that grant higher privileges but are named for their bug class are not included. Our October 2026 exploited vulnerabilities roundup shows recent elevation bugs in context.

Windows privilege escalation techniques

On Windows the goal is local administrator, then SYSTEM. The routes testers find most:

Technique	ATT&CK	What it abuses	What a finding means
Unpatched elevation bugs	T1068	Flaws in the kernel, drivers and system services	Local fixes deferred on the theory that an attacker needs access first
Weak service, task and installer configuration	T1543.003, T1574.009 to .011, T1053.005	Service binaries, folders, registry keys or task scripts a user can modify; unquoted paths; the AlwaysInstallElevated policy	Software installed with loose permissions nobody reviewed
DLL search-order hijacking	T1574.001	A privileged program loading a library from a user-writable folder	Writable paths that privileged code trusts
Token impersonation	T1134.001	The impersonation right Windows gives service accounts by design	A compromised web app or database means a compromised server
UAC bypass	T1548.002	A user who is already a local administrator	Users hold admin rights they do not need
Credentials on disk	T1552	Install answer files, scripts, saved credentials, old Group Policy Preferences passwords	Secrets readable by any user
Shared local admin password	T1078.003	One local administrator password on many machines	One escalation becomes every host

What gets planted in those writable paths is usually a generated payload; our msfvenom explainer covers the controls that stop it.

Two Microsoft positions shape the fixes. Its Windows security servicing criteria treat UAC as defense in depth, not a security boundary, so bypasses are not serviced as vulnerabilities, and administrator-to-kernel is not a boundary either. If users are local administrators, assume malware running as them becomes one. Bring-your-own-vulnerable-driver (BYOVD) attacks, which load a signed but flawed driver to reach the kernel, usually come after admin rights, commonly to switch off endpoint protection.

Linux privilege escalation techniques

On Linux the goal is root:

Technique	ATT&CK	What it abuses	What a finding means
Over-broad sudo rules	T1548.003	Editors, interpreters, package managers or wildcards runnable as root, often without a password	Sudoers grew by exception
SUID binaries and file capabilities	T1548.001	Programs that run as their owner (usually root) whoever starts them; NFS exports with no_root_squash	Non-standard SUID files added for convenience
Kernel and root-utility bugs	T1068	PwnKit in polkit (CVE-2021-4034), the nf_tables flaw (CVE-2024-1086), the sudo chroot bug (CVE-2025-32463)	Patch lag on long-lived servers
Writable root jobs	T1053.003, T1543.002	Cron jobs, systemd units or their scripts editable by a non-root user	File permission drift
Secrets in files	T1552	SSH keys, .env files, shell history, database configs	Credentials for a more privileged account
Container escape and root-equivalent groups	T1611	Privileged containers, a mounted runtime socket, host path mounts, docker, lxd or disk group membership	The container boundary was never configured

CISA marks PwnKit and the nf_tables bug as used in ransomware campaigns. The sudo bug shows why a server patched last year can still be exposed: per the sudo project’s advisory, versions 1.9.14 through 1.9.17 let a local user run commands as root even when not listed in sudoers, fixed in 1.9.17p1. Docker’s documentation warns that the docker group grants root-level privileges.

Domain and cloud privilege escalation

The largest escalations are often not on a host. In Active Directory, any domain user can usually read enough to find a path: crackable service accounts (Kerberoasting), ACLs that let one group reset another’s password, unconstrained delegation, membership of privileged groups such as Backup Operators, Server Operators or DnsAdmins, Group Policy objects editable by the wrong people (T1484.001), and certificate templates that let a user enroll as anyone. BloodHound maps those paths, our AD CS attacks guide covers certificates, and each fix has a check in the Active Directory hardening checklist. Zerologon (CVE-2020-1472) and Certifried (CVE-2022-26923) are both in CISA’s catalog.

Coerced authentication is a domain path too. NTLM relay to AD CS turns a forced logon from a domain controller into a certificate issued in its name, and the fix sits on the certificate server, not on the hosts.

In the cloud, the equivalent is an identity that can grant itself more: an AWS principal that can pass a privileged role or rewrite its own policy, or an Entra ID account that can assign directory roles. Our AWS penetration testing guide lists the common IAM chains, and the Azure penetration testing guide covers the Entra ID side.

Cloud privilege escalation paths in AWS, Entra ID and GCP

Cloud	Typical path	Where it shows	Control
AWS	A principal allowed to pass any role hands a more privileged one to a service it controls. AWS notes that PassRole is a permission, not an API call	The CloudTrail record of the call that created or changed the resource, such as CreateFunction	Limit iam:PassRole to named roles, with the iam:PassedToService condition
Entra ID	An Application Administrator adds a credential to an application and acts as it, which Microsoft warns may be an elevation of privilege; a Privileged Role Administrator can manage role assignments outright	Entra audit log: application credential changes and “Add member to role”	Few standing holders of either role, and a review of what each application is permitted to do
GCP	A principal with iam.serviceAccounts.getAccessToken, for example through the Service Account Token Creator role, impersonates a service account and can access whatever it can	Cloud Audit Logs, which record both identities	Grant the role on single service accounts, not project-wide

How to detect privilege escalation

Each escalation leaves a record (a process with more rights than its parent, a new service, a group change) if the audit policy is on and the logs leave the host. A tester reaching SYSTEM unnoticed is a finding in itself.

Signal	Log source	Event or field	What it means
Elevated process from a user context	Security log, Audit Process Creation	4688 with Token Elevation Type %%1936 or %%1937, or a System-integrity label (S-1-16-16384) created by a user application	A user process reached admin or SYSTEM
Sensitive rights at logon	Security log, Audit Special Logon	4672 listing SeDebugPrivilege, SeImpersonatePrivilege or SeLoadDriverPrivilege for an unexpected account	An account gained admin-class rights
New service or task	Security and System logs	4697 and 7045 (binary outside Windows or Program Files, or a kernel driver); 4698	Escalation or persistence
Privileged group change	Security log, Audit Security Group Management	4732 (local and domain-local groups, including Administrators on domain controllers); 4728 (global, such as Domain Admins); 4756 (universal)	An account added to Administrators or a privileged group
Driver loaded or blocked	Sysmon; CodeIntegrity Operational	Sysmon 6; 3076 (audit) and 3077 (block)	A BYOVD attempt
Root process from a non-root login	Linux auditd	Executions with effective UID 0 but a normal user’s login UID (auid), outside expected sudo use	A user session produced a root process
Sudo probing and privilege file changes	auth.log or secure; auditd watches; file integrity monitoring	Failed sudo attempts; writes to sudoers, passwd, cron or systemd units; new SUID files	Preparation for escalation or persistence
Cloud self-escalation	AWS CloudTrail; Entra ID audit log	CreatePolicyVersion, SetDefaultPolicyVersion, Attach and Put policy calls, UpdateAssumeRolePolicy; PassRole is not logged, so check the role passed in calls such as CreateFunction or RunInstances; Entra “Add member to role”	An identity granting itself rights

Microsoft’s 4688 reference recommends watching %%1937 (elevated token) on standard workstations, and %%1936 on a real user account, which usually means UAC is off for it. Enable command-line logging too; it is a separate policy.

Attackers and testers usually find these paths with enumeration scripts such as WinPEAS and LinPEAS, which list misconfigurations rather than exploit anything. In logs they look like a burst of discovery commands from one session inside a minute or two: privilege and group queries, service and scheduled task listings, searches for SUID files. Command-line logging on 4688 and auditd execution records capture it.

How to prevent privilege escalation

Improper separation of user and administrator privilege is one of the ten most common network misconfigurations in the joint NSA and CISA top ten misconfigurations advisory. Most controls below fix that; the rest is patching local bugs as fast as perimeter ones, because attackers already hold the foothold a local bug needs.

Windows

Control	What it closes
Standard user accounts for daily work; no local admin for users	UAC bypass and most malware elevation
Windows LAPS, built in since the April 11, 2023 updates	One local admin password everywhere
KEV-listed elevation bugs patched in days, on workstations and servers	Exploitation for privilege escalation
The vulnerable driver blocklist (on by default since the Windows 11 2022 update), memory integrity, and the attack surface reduction rule against vulnerable signed drivers	BYOVD
Service, task and program folder permissions reviewed after installs; quoted service paths	Weak services and DLL hijacking
Least-privilege group managed service accounts, and tiered administration	A compromised server or service account becoming domain compromise

Windows 11 also has Administrator protection, which keeps administrators unprivileged and issues a short-lived, isolated admin token after a Windows Hello check. It began rolling out, off by default, in the optional August 27, 2026 preview update for 24H2 and 25H2 (KB5120998); organizations applying Microsoft’s security baselines get it on from the October 2026 security update. Microsoft currently advises against it on LAPS-managed devices, so pilot it first.

Linux and containers

• Sudo by command, not by person: no shells, editors or interpreters unless root is the intent, passwords required, sudo 1.9.17p1 or later.
• A SUID and capabilities baseline, diffed after every image build.
• Kernel patching with a deadline, live patching where available, and unprivileged user namespaces restricted where workloads allow.
• Root-owned jobs only root can edit, including every script they call.
• Docker group membership managed like sudo, because it is equivalent.
• The Kubernetes Restricted pod security standard: privilege escalation off, non-root users, all capabilities dropped. Our Kubernetes penetration testing checks the pod-to-node and pod-to-cloud paths these settings close, and the Kubernetes security checklist lists the settings.

How Invadel tests for privilege escalation, and what it costs

Privilege escalation is part of every internal engagement. From the foothold agreed at scoping, usually one standard domain user, a senior tester checks each host type we reach for local escalation, then works the domain paths toward Domain Admin. Exploits that could crash a host, kernel exploits especially, run only where the rules of engagement allow; elsewhere we prove the path with version and permission evidence. Each step becomes a finding with proof, the fix and the events your monitoring should have raised. Our infrastructure penetration testing guide shows how the scope is counted.

Engagement	Question it answers	From
Internal network penetration test	Which hosts let a standard user become SYSTEM or root, and how far that reaches	$6,000 Small, $9,200 Medium, $14,500+ Large
Active Directory security assessment	How one standard user reaches Domain Admin through Kerberos, delegation, ACL, GPO, AD CS or hybrid paths	$6,000
Thick client penetration test	Whether a desktop app’s services, DLL loading, file permissions or IPC hand a user admin rights	$6,000; $9,200 with a local SYSTEM service
Cloud penetration test	Which identities and workloads in AWS, Azure or GCP can grant themselves more	$6,800
Kubernetes penetration test	Whether a pod can reach its node or the cloud account behind it	$6,800 for one cluster
Red team	Whether your team detects and stops the chain	$12,500

Once the findings are fixed, the free retest re-checks each host where a standard user reached SYSTEM or root and each identity that could grant itself more. Every engagement is priced in writing and includes executive and technical reports and an attestation letter, and onboarding starts within 24 hours of a signed proposal. The sample report shows how an escalation chain is written up, and the pricing page lists every service.

Frequently asked questions

What are the two types of privilege escalation? Vertical, where an attacker gains a higher level of access such as administrator or root, and horizontal, where they reach another account’s access at the same level.

What is an example of a privilege escalation attack? In 2025 a ransomware group used CVE-2025-29824, a Windows Common Log File System zero-day, to go from a standard user to SYSTEM, dumped credentials, then encrypted files. On Linux, CISA marks CVE-2024-1086 as used in ransomware campaigns.

Does Microsoft fix UAC bypasses? Not as security vulnerabilities. Microsoft treats UAC as defense in depth rather than a security boundary, so the fix is to stop giving users local administrator rights.

How do you prevent privilege escalation? Remove users from local Administrators, deploy Windows LAPS, patch exploited elevation bugs within days, keep sudo rules narrow, review permissions after installs, and alert on elevated-token 4688 events from user sessions, new services (4697, 7045) and additions to Administrators (4732).

How much does it cost to test for privilege escalation? There is no standalone price, because escalation is tested where it happens: on hosts in an internal network test and in the domain in an Active Directory assessment (both from $6,000), and in cloud accounts or a Kubernetes cluster from $6,800, each fixed in writing with a free retest.

What is the difference between privilege escalation and lateral movement? Privilege escalation raises what an attacker can do on a system or in a directory; lateral movement takes them to another system. Real intrusions alternate between the two.

The short version

Privilege escalation turns a foothold into control: SYSTEM or root on a host, Domain Admin on the network, admin in the cloud. It usually rides on configuration (local admin sprawl, weak services, broad sudo rules, shared passwords) plus exploited elevation bugs, and each step leaves events you can alert on. To learn how far one standard account gets in your network, see internal network penetration testing, check the internal network testing prices, or scope your test.