Cross-source coverage

T1068 / ATT&CK

Exploitation for Privilege Escalation

219 rules · 201 families across 9 sources.

9 deprecated hidden · include 3 atomic-IOC hidden · include

From MITRE ATT&CK 19.2

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

When initially gaining access to a system, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system. Vulnerabilities may exist, usually in operating system components and software commonly running at higher permissions, that can be exploited to gain higher levels of access on the system. This could enable someone to move from unprivileged or user level permissions to SYSTEM or root permissions depending on the component that is vulnerable. This could also enable an adversary to move from a virtualized environment, such as within a virtual machine or container, onto the underlying host. This may be a necessary step for an adversary compromising an endpoint system that has been properly configured and limits other privilege escalation methods.

Adversaries may bring a signed vulnerable driver onto a compromised machine so that they can exploit the vulnerability to execute code in kernel mode. This process is sometimes referred to as Bring Your Own Vulnerable Driver (BYOVD). Adversaries may include the vulnerable driver with files delivered during Initial Access or download it to a compromised system via Ingress Tool Transfer or Lateral Tool Transfer.

Platforms
Containers · Linux · macOS · Windows
Telemetry
WinEventLog:SysmonWinEventLog:Securityauditd:SYSCALLmacos:unifiedlogmacos:endpointsecuritycontainerd:runtime

How MITRE says to detect it DET0514

Detection Strategy for Exploitation for Privilege Escalation

Windows Analytic 1419

Detects exploitation attempts targeting vulnerable kernel drivers or OS components, often followed by unusual process or token behavior.

  • WinEventLog:Sysmon EventCode=6
  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Security EventCode=4672

Linux Analytic 1420

Detects escalation via vulnerable setuid binaries or kernel modules, often chained with unusual access to /proc/kallsyms or /dev/kmem.

  • auditd:SYSCALL execve
  • auditd:SYSCALL ACCESS
  • auditd:SYSCALL dmesg

macOS Analytic 1421

Detects use of vulnerable kernel extensions or entitlements abused via setuid or AppleScript injection chains.

  • macos:unifiedlog process:exec and kext load events
  • macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_KEXTLOAD

Containers Analytic 1422

Detects container breakout behavior via exploitation (e.g., DirtyPipe, CVE-2022-0847), followed by host OS interaction or escalated capability assignment.

  • auditd:SYSCALL capset or setns
  • containerd:runtime e.g., containerd, Docker events

View on attack.mitre.org ↗

elastic/detection-rules

58 rules
Detection Severity Format
Potential Telnet Authentication Bypass (CVE-2026-24061) Critical Elastic TOML
Telnet Authentication Bypass via User Environment Variable Critical Elastic TOML
Exploit - Detected - Elastic Endgame High Elastic TOML
Persistence via Update Orchestrator Service Hijack High Elastic TOML
Potential CertiGhost AD CS Machine Identity Mismatch (CVE-2026-54121) High Elastic TOML
Potential Copy Fail (CVE-2026-31431) Exploitation via AF_ALG Socket High Elastic TOML
Potential CVE-2025-32463 Nsswitch File Creation High Elastic TOML
Potential CVE-2025-32463 Sudo Chroot Execution Attempt High Elastic TOML
Potential Escalation via Vulnerable MSI Repair High Elastic TOML
Potential Privileged Escalation via SamAccountName Spoofing High Elastic TOML

+ 48 more from elastic/detection-rules → showing the 10 highest-severity

elastic/protections-artifacts

58 rules
Detection Severity Format
BLF File Creation by an Unusual Process Undefined Elastic TOML
CVE-2023-0386 Exploitation Attempt Undefined Elastic TOML
Driver Dropped by Untrusted Executable Undefined Elastic TOML
Elevation via Common Log File System Exploitation Undefined Elastic TOML
General Privilege Escalation Sequence Detected Undefined Elastic TOML
Kernel Driver Registered via NtLoadDriver Undefined Elastic TOML
MSI Rollback Script File by Unusual Process Undefined Elastic TOML
Potential Cgroup Privilege Escalation/Container Escape via Mount Undefined Elastic TOML
Potential Common Log File System Exploit Undefined Elastic TOML
Potential Common Log File System Vulnerability Exploitation Undefined Elastic TOML

+ 48 more from elastic/protections-artifacts → showing the 10 highest-severity

splunk/security_content

51 rules
Detection Severity Format
Child Processes of Spoolsv exe Undefined SPL
Cisco Isovalent - Kprobe Spike Undefined SPL
Detect Baron Samedit CVE-2021-3156 Undefined SPL
Detect Baron Samedit CVE-2021-3156 Segfault Undefined SPL
Detect Baron Samedit CVE-2021-3156 via OSQuery Undefined SPL
First Time Seen Child Process of Zoom Undefined SPL
Linux Apparmor Bypass Via Aaexec Undefined SPL
Linux Auditd Copy Fail Privilege Escalation Undefined SPL
Linux Auditd Possible Setuid Execve Privesc Undefined SPL
Linux Binary Launched Process with Null Argv Undefined SPL

+ 41 more from splunk/security_content → showing the 10 highest-severity

SigmaHQ/sigma

28 rules
Detection Severity Format
Audit CVE Event Critical Sigma
Exploiting CVE-2019-1388 Critical Sigma
InstallerFileTakeOver LPE CVE-2021-41379 File Create Event Critical Sigma
Possible Coin Miner CPU Priority Param Critical Sigma
Potential CVE-2021-41379 Exploitation Attempt Critical Sigma
Potential SystemNightmare Exploitation Attempt Critical Sigma
Sudo Privilege Escalation CVE-2019-14287 - Builtin Critical Sigma
Authencesn Crypto Module Load via Modprobe - Copy-Fail Indicator High Sigma
Buffer Overflow Attempts High Sigma
Exploiting SetupComplete.cmd CVE-2019-1378 High Sigma

+ 18 more from SigmaHQ/sigma → showing the 10 highest-severity

socfortress/Wazuh-Rules

12 rules · 2 families
Detection Severity Format
Detects command line parameter very often used with coin miners. 8 variants High Wazuh XML
Detects command line parameter very often used with coin miners. 8 variants High Wazuh XML
Detects command line parameter very often used with coin miners. 8 variants High Wazuh XML
Detects command line parameter very often used with coin miners. 8 variants High Wazuh XML
Detects command line parameter very often used with coin miners. 8 variants High Wazuh XML
Detects command line parameter very often used with coin miners. 8 variants High Wazuh XML
Detects command line parameter very often used with coin miners. 8 variants High Wazuh XML
Detects command line parameter very often used with coin miners. 8 variants High Wazuh XML
Detects exploitation attempt of vulnerability described in CVE-2021-3156. 4 variants High Wazuh XML
Detects exploitation attempt of vulnerability described in CVE-2021-3156. 4 variants High Wazuh XML

+ 2 more from socfortress/Wazuh-Rules → showing the 10 highest-severity

Wazuh Core Ruleset

7 rules · 5 families
Detection Severity Format
of an user. Critical Wazuh XML
Shellshock attack detected 2 variants Critical Wazuh XML
Shellshock attack detected 2 variants Critical Wazuh XML
sshd: OpenSSH challenge-response exploit. Critical Wazuh XML
MS Exchange - Possible deserialization exploitation (CVE-2021-26857). High Wazuh XML
Shellshock attack attempt 2 variants Medium Wazuh XML
Shellshock attack attempt 2 variants Medium Wazuh XML

Azure/Azure-Sentinel

2 rules
Detection Severity Format
Email access via active sync Medium KQL
Potential Local Exploitation for Privilege Escalation Undefined KQL

panther-labs/panther-analysis

2 rules
Detection Severity Format
Kubernetes Pod with Dangerous Linux Capabilities High Panther Python
Azure Automation Schedule Created or Modified Informational Panther Python

chronicle/detection-rules

1 rule
Detection Severity Format
hacktool_sharp_successor_execution High YARA-L

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.