UNC3886G1048 ↗
Has exploited zero-day vulnerability CVE-2023-20867 to enable execution of privileged commands across Windows, Linux, and PhotonOS (vCenter) guest VMs.1
tfMITRE ATT&CK technique
Exploitation for Privilege Escalation T1068
- Tactic
- Privilege Escalation
- Platforms
- Containers, Linux, macOS, Windows
- Version
- 1.6
- Created
- 31 May 2017
- Last modified
- 24 October 2025
- Contributors
- Joas Antonio dos Santos, @C0d3Cr4zy, Inmetrics; Yaniv Agman, @AgmanYaniv, Team Nautilus Aqua Security; Idan Revivo, @idanr86, Team Nautilus Aqua Security; David Tayouri
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
22
Threat groupsTop 8%
Threat groups92nd percentile · 92% of ATT&CK techniques have this many threat groups attributed or fewer.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.19
Tools & malwareTop 18%
Tools & malware82nd percentile · 82% of ATT&CK techniques have this many tools implementing them or fewer.87
Detection rulesTop 2%
Detection rules98th percentile · 98% of ATT&CK techniques have this many detection rules written or fewer.Exploitation for Privilege Escalation MITRE reference T1068
Top 8%of all ATT&CK techniques for number of groups
22 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
BlackByteG1043 ↗
Has exploited CVE-2024-37085 in VMWare ESXi software for authentication bypass and subsequent privilege escalation.1
MoustachedBouncerG1019 ↗
Has exploited CVE-2021-1732 to execute malware components with elevated rights.1
Volt TyphoonG1017 ↗
Has gained initial access by exploiting privilege escalation vulnerabilities in the operating system or network services.1
Scattered SpiderG1015 ↗
Has deployed a malicious kernel driver through exploitation of CVE-2015-2291 in the Intel Ethernet diagnostics driver for Windows (iqvw64.sys).1
LAPSUS$G1004 ↗
Has exploited unpatched vulnerabilities on internally accessible servers including JIRA, GitLab, and Confluence for privilege escalation.1
All 22 groups for this technique · 6 newest in this preview
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
ShadowRayC0045 ↗
During ShadowRay, threat actors downloaded a privilege escalation payload to gain root access.1
Leviathan Australian IntrusionsC0049 ↗
Leviathan exploited software vulnerabilities in victim environments to escalate privileges during Leviathan Australian Intrusions.1
All 2 campaigns for this technique
19 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
EmbargoS1247 ↗
Has leveraged MS4Killer to deliver a vulnerable driver to the victim device, sometimes referred to as Bring Your Own Vulnerable Driver (BYOVD).1 Embargo has utilized the vulnerable driver probmon.sys version 3.0.0.4 which had a revoked certificated from “ITM System Co.,LTD.”1
BlackByte 2.0 RansomwareS1181 ↗
Exploits a vulnerability in the RTCore64.sys driver (CVE-2019-16098) to enable privilege escalation and defense evasion when run as a service.1
ZeroCleareS1151 ↗
Has used a vulnerable signed VBoxDrv driver to bypass Microsoft Driver Signature Enforcement (DSE) protections and subsequently load the unsigned RawDisk driver.1
ZoxS0672 ↗
Has the ability to leverage local and remote exploits to escalate privileges.1
PandoraS0664 ↗
Can use CVE-2017-15303 to bypass Windows Driver Signature Enforcement (DSE) protection and load its driver.1
XCSSETS0658 ↗
Has used a zero-day exploit in the ssh launchdaemon to elevate privileges and bypass SIP.1
All 19 software entries for this technique · 6 newest in this preview
Offense vs defense T1068
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 2Sigma rules (cumulative) · 36Splunk ESCU (cumulative) · 51
first rule: 2017 Q1 · 2 of 2 campaigns plottedExploitation for Privilege Escalation detection strategy DET0514
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Exploitation for Privilege Escalation
4 platforms
AN1419 · Windows
Detects exploitation attempts targeting vulnerable kernel drivers or OS components, often followed by unusual process or token behavior.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Driver LoadDC0079 | WinEventLog:Sysmon | EventCode=6 |
| Logon Session MetadataDC0088 | WinEventLog:Security | EventCode=4672 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| DriverNamePattern | Targeted BYOVD drivers may vary based on campaign and tooling. |
| TimeWindow | Controls temporal linking of driver load → process spawn → privilege use. |
| ParentProcessPath | Parent-child relationships vary by exploitation vector (e.g., LOLBin vs. dropper). |
AN1420 · Linux
Detects escalation via vulnerable setuid binaries or kernel modules, often chained with unusual access to /proc/kallsyms or /dev/kmem.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | auditd:SYSCALL | dmesg |
| Process CreationDC0032 | auditd:SYSCALL | execve |
| Process AccessDC0035 | auditd:SYSCALL | ACCESS |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| SetUIDBinaryList | Legitimate SUID binaries vary across distributions; false positives may arise. |
| TimeWindow | Allows chaining kernel module load with privilege spike or privilege-sensitive process activity. |
| EffectiveUIDThreshold | Default is uid=0, but environments may vary with containerized root-like accounts. |
AN1421 · macOS
Detects use of vulnerable kernel extensions or entitlements abused via setuid or AppleScript injection chains.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | macos:endpointsecurity | ES_EVENT_TYPE_NOTIFY_KEXTLOAD |
| Process CreationDC0032 | macos:unifiedlog | process:exec and kext load events |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| EntitlementList | Entitlements vary by app and OS version; some allow unexpected behavior. |
| TimeWindow | Correlate SUID execution or AppleScript injection with privilege gain or module load. |
AN1422 · Containers
Detects container breakout behavior via exploitation (e.g., DirtyPipe, CVE-2022-0847), followed by host OS interaction or escalated capability assignment.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Logon Session CreationDC0067 | auditd:SYSCALL | capset or setns |
| Container EnumerationDC0091 | containerd:runtime | e.g., containerd, Docker events |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| NamespaceEscapePattern | May vary with CVE technique or custom syscall wrapper. |
| TimeWindow | Controls correlation of breakout → host interaction. |
1 analytic
After gaining initial access to a system, threat actors attempt to escalate privileges as they may be operating within a lower privileged process which does not allow them to access protected information or carry out tasks which require higher permissions. A common way of escalating privileges in a system is by externally invoking and exploiting spoolsv or connhost executables, both of which are legitimate Windows applications. This query searches for an invocation of either of these executables by a user, thus alerting us of any potentially malicious activity.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PSA | Process Spawn Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | command_line |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
This query looks for processes spawned by spoolsv.exe or connhost.exe externally, thus alerting us of potentially malicious activity.
(index=__your_sysmon_index__ EventCode=1) (Image=C:\\Windows\\System32\\spoolsv.exe* OR Image=C:\\Windows\\System32\\conhost.exe) ParentImage = "C:\\Windows\\System32\\cmd.exe"
Make it difficult for adversaries to advance their operation through exploitation of undiscovered or unpatched vulnerabilities by using sandboxing. Other types of virtualization and application microsegmentation may also mitigate the impact of some types of exploitation. Risks of additional exploits and weaknesses in these systems may still exist.
Execution PreventionM1038
Consider blocking the execution of known vulnerable drivers that adversaries may exploit to execute code in kernel mode. Validate driver block rules in audit mode to ensure stability prior to production deployment.
Exploit ProtectionM1050
Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. Many of these protections depend on the architecture and target application binary for compatibility and may not work for software components targeted for privilege escalation.
Develop a robust cyber threat intelligence capability to determine what types and levels of threat may use software exploits and 0-days against a particular organization.
Update SoftwareM1051
Update software regularly by employing patch management for internal enterprise endpoints and servers.