ATT&CK Privilege Escalation Tactic (TA0004) Hub

An attacker who lands as an ordinary user or workload rarely has the rights to do damage, so the Privilege Escalation tactic (TA0004) is where a foothold becomes domain admin, root, Global Administrator or cloud account owner. MITRE ATT&CK v20 defines the tactic as the adversary "trying to gain higher-level permissions", and names the targets as SYSTEM or root, local administrator, accounts with admin-like access and accounts that can reach a specific system or function. This hub covers the whole tactic: what the 13 techniques and 83 sub-techniques have in common, which ones dominate the procedure data, how real intrusions chain them across hosts, identity providers and cloud control planes, and where detection and hardening effort pays back first. It links to each technique guide for depth and is written for detection engineers, identity and cloud platform teams and threat hunters.

Key takeaways

Most escalation reuses persistence mechanics. Ten of the 13 techniques also sit under Persistence, Stealth, Execution, Initial Access or Defense Impairment; only T1068, T1548 and T1611 belong to Privilege Escalation alone.
Autostart, services and scheduled tasks dominate the data. Registry Run Keys (T1547.001, 267 procedure records), Scheduled Task (T1053.005, 193) and Windows Service (T1543.003, 141) lead the v20 dataset because they run code as SYSTEM.
Identity is now an escalation surface. Account Manipulation (T1098), Valid Accounts (T1078) and Domain or Tenant Policy Modification (T1484) turn one admin session into tenant-wide control, as the SolarWinds and Scattered Spider campaigns show.
Two mitigations cover the most ground. In v20, User Account Management (M1018) maps to 35 techniques in this tactic and Privileged Account Management (M1026) to 31, more than any endpoint control.
Detect the grant, not just the exploit. Role assignments, group additions, new service principals, federation changes and new services are discrete, loggable events that are cheaper to alert on than kernel exploitation.

What the tactic covers and how the numbers were counted

Privilege escalation in ATT&CK is not one action but a property of where code runs or which identity it runs as. A scheduled task created as SYSTEM, a token stolen from an administrator's process, a role assignment in Entra ID and a container breakout to the node all end in the same place: more permission than the adversary started with. ATT&CK v20 also notes that these techniques often overlap with Persistence, because OS features that let an adversary persist can run in an elevated context.

The figures on this page come from the ATT&CK v20.0 Enterprise STIX bundle. We counted every technique and sub-technique carrying the privilege-escalation phase (revoked and deprecated objects excluded), then counted "uses" relationships from groups, software and campaigns to each one. The result is 96 entries (13 techniques, 83 sub-techniques) with 1,538 procedure records from 122 groups, 495 software entries and 36 campaigns. Procedure counts measure what has been publicly reported and mapped, not what is most dangerous, so they bias towards Windows malware families. Treat them as a guide to coverage priorities, not a risk ranking.

The three escalation planes

Grouping the techniques by where the higher permission lives makes coverage planning easier than working through the matrix alphabetically.

Plane	Techniques	What the adversary gains	Primary telemetry
Host: execution in a privileged context	T1037, T1053, T1543, T1546, T1547, T1055	Code that runs as SYSTEM or root at boot, logon, on a schedule, on an event or inside a privileged process	Sysmon, Windows Security log, auditd, macOS Endpoint Security, EDR
Host: bypassing elevation controls	T1548, T1134, T1068, T1611	Admin or kernel rights without a legitimate prompt or credential; escape from a container to its host	Process creation with integrity level, token API telemetry, driver loads, container runtime and Kubernetes audit logs
Identity and control plane	T1078, T1098, T1484, T1548.005	Administrator roles, extra credentials on apps and service principals, trusted federation or Group Policy, temporary elevated cloud access	Directory audit logs, IdP system logs, Microsoft 365 unified audit log, AWS CloudTrail, GCP audit logs, AD event 5136

The identity plane carries fewer procedure records but larger blast radius. A Run key gives one host; a new owner credential on a privileged service principal or a rogue federated identity provider gives every resource the tenant controls. For the identity side of escalation see the MITRE ATT&CK T1484 Domain or Tenant Policy Modification Guide; for AWS-specific paths see How to Find IAM Privilege Escalation Paths in AWS.

Every technique in the tactic

The table lists every current Privilege Escalation technique in ATT&CK v20 with its sub-techniques. The record count is the family total (technique plus its sub-techniques) using the method above.

Technique	Sub-techniques	Procedure records	Also under
T1037 Boot or Logon Initialization Scripts	.001 Logon Script (Windows), .002 Login Hook, .003 Network Logon Script, .004 RC Scripts, .005 Startup Items	25	Persistence
T1053 Scheduled Task/Job	.002 At, .003 Cron, .005 Scheduled Task, .006 Systemd Timers, .007 Container Orchestration Job	223	Execution, Persistence
T1055 Process Injection	.001 Dynamic-link Library Injection, .002 Portable Executable Injection, .003 Thread Execution Hijacking, .004 Asynchronous Procedure Call, .005 Thread Local Storage, .008 Ptrace System Calls, .009 Proc Memory, .011 Extra Window Memory Injection, .012 Process Hollowing, .013 Process Doppelgänging, .014 VDSO Hijacking, .015 ListPlanting	242	Stealth
T1068 Exploitation for Privilege Escalation	None	44	None
T1078 Valid Accounts	.001 Default Accounts, .002 Domain Accounts, .003 Local Accounts, .004 Cloud Accounts	158	Initial Access, Persistence, Stealth
T1098 Account Manipulation	.001 Additional Cloud Credentials, .002 Additional Email Delegate Permissions, .003 Additional Cloud Roles, .004 SSH Authorized Keys, .005 Device Registration, .006 Additional Container Cluster Roles, .007 Additional Local or Domain Groups	47	Persistence
T1134 Access Token Manipulation	.001 Token Impersonation/Theft, .002 Create Process with Token, .003 Make and Impersonate Token, .004 Parent PID Spoofing, .005 SID-History Injection	69	Stealth
T1484 Domain or Tenant Policy Modification	.001 Group Policy Modification, .002 Trust Modification	21	Defense Impairment
T1543 Create or Modify System Process	.001 Launch Agent, .002 Systemd Service, .003 Windows Service, .004 Launch Daemon, .005 Container Service	203	Persistence
T1546 Event Triggered Execution	.001 Change Default File Association, .002 Screensaver, .003 Windows Management Instrumentation Event Subscription, .004 Unix Shell Configuration Modification, .005 Trap, .006 LC_LOAD_DYLIB Addition, .007 Netsh Helper DLL, .008 Accessibility Features, .009 AppCert DLLs, .010 AppInit DLLs, .011 Application Shimming, .012 Image File Execution Options Injection, .013 PowerShell Profile, .014 Emond, .015 Component Object Model Hijacking, .016 Installer Packages, .017 Udev Rules, .018 Python Startup Hooks	82	Persistence
T1547 Boot or Logon Autostart Execution	.001 Registry Run Keys / Startup Folder, .002 Authentication Package, .003 Time Providers, .004 Winlogon Helper DLL, .005 Security Support Provider, .006 Kernel Modules and Extensions, .007 Re-opened Applications, .008 LSASS Driver, .009 Shortcut Modification, .010 Port Monitors, .012 Print Processors, .013 XDG Autostart Entries, .014 Active Setup, .015 Login Items	339	Persistence
T1548 Abuse Elevation Control Mechanism	.001 Setuid and Setgid, .002 Bypass User Account Control, .003 Sudo and Sudo Caching, .004 Elevated Execution with Prompt, .005 Temporary Elevated Cloud Access, .006 TCC Manipulation	80	None
T1611 Escape to Host	None	5	None

Where to start: ranked techniques for defenders

The ranking below weighs procedure volume, blast radius and how cheaply a detection or control can be built. It is a starting order, not a substitute for your own threat model.

T1098 Account Manipulation and T1078 Valid Accounts in the identity plane: role additions (T1098.003), extra credentials on apps (T1098.001) and new group members (T1098.007) are single audit events with tenant-wide impact. Start here if you run Entra ID, Okta, AWS or Google Cloud.
T1484 Domain or Tenant Policy Modification: a new federated identity provider or a changed domain authentication setting lets an adversary mint access for any user. Rare, high signal, critical.
T1543.003 Windows Service and T1053.005 Scheduled Task: very common, run as SYSTEM, and well covered by Security Event IDs 4697 and 4698 and by Sysmon. Baseline the legitimate ones and alert on the rest.
T1548.002 Bypass User Account Control: 64 procedure records. Where users are local administrators, UAC bypass is the routine step from medium to high integrity. Removing local admin rights removes most of the value.
T1068 Exploitation for Privilege Escalation: includes bring-your-own-vulnerable-driver. Patch cadence and the vulnerable driver blocklist matter more than detection here.
T1134 Access Token Manipulation and T1055 Process Injection: high volume but best left to EDR behaviour rules; invest in tuning and testing rather than custom analytics.
T1611 Escape to Host and T1548.005 Temporary Elevated Cloud Access: few records, but rising with containers and just-in-time cloud access. Admission control and scoped impersonation rights prevent most of it.

How intrusions chain escalation

ATT&CK v20 maps 36 campaigns to this tactic. The two with the most Privilege Escalation techniques show the shift from host to identity escalation.

SolarWinds Compromise (C0024, 11 techniques): APT29 used compromised domain administrator accounts (T1078.002), then a compromised Office 365 administrator account to create a new service principal (T1078.004), granted it company administrator privileges (T1098.003), added credentials to OAuth applications and service principals (T1098.001), and changed domain federation trust settings so the tenant accepted tokens signed by their own SAML signing certificate (T1484.002). On hosts, a WMI event subscription launched a backdoor at boot (T1546.003). The SolarWinds supply chain compromise page covers how forged SAML tokens and hijacked application identities reached customer tenants.
Scattered Spider (G1015) and campaign C0027: ATT&CK records the group authenticating to Azure tenants with compromised user credentials (T1078.004), using IAM manipulation to assume or elevate privileges (T1098.003), assigning User Access Administrator to gain Tenant Root Group management in Azure, registering MFA devices (T1098.005), adding accounts to the ESX Admins group for full vSphere rights (T1098), adding a federated identity provider with automatic account linking (T1484.002) and loading a malicious kernel driver through a vulnerable Intel driver, CVE-2015-2291 (T1068). In the MGM Resorts breach, the attackers claimed administrator control of the Okta and Azure tenants after a help desk call, then ransomware on more than 100 ESXi hypervisors; MGM estimated a roughly $100 million impact.
Cutting Edge (C0029): threat actors exploiting Ivanti Connect Secure injected shared objects into web process memory on the appliance (T1055) and used compromised VPN accounts (T1078.002) to move on.

The common pattern is short: valid credentials, one privileged grant, then a durable foothold in the control plane that survives password resets. Escalation also feeds directly into credential theft; see the ATT&CK Credential Access Tactic Guide.

Where non-human identities fit

Several escalation paths run through machine identities rather than people. T1098.001 adds credentials to an existing application or service principal that already holds high Graph or cloud permissions, so the adversary inherits rights nobody is watching. T1548.005 covers impersonation and role passing: in AWS, iam:PassRole lets a user hand a role to a service, and AWS warns that passing a role lets the user indirectly use that role's permissions. AWS recommends scoping the Resource to specific roles and using the iam:PassedToService condition key; it also notes that PassRole is a permission, not an API call, so CloudTrail records the action that created the resource (for example CreateFunction) rather than the pass itself. In Google Cloud the equivalent risk is broad serviceAccountTokenCreator grants. Inventory which workloads can mint or assume privileged identities; see the MITRE ATT&CK T1098.001 Account Manipulation guide.

Detection priorities across the tactic

Every technique has a v20 detection strategy. The ones below give the widest coverage for the least engineering, with the log sources ATT&CK names in their analytics.

Technique	v20 detection strategy	Log sources named	What to alert on
T1098.003 Additional Cloud Roles	DET0277	AWS CloudTrail AttachUserPolicy, CreatePolicyVersion, PutRolePolicy; Microsoft 365 audit "Add member to role"	Privileged role assignment outside change windows or straight after a risky sign-in
T1098.007 Local or Domain Groups	DET0310	Security Event IDs 4728, 4732 and 4756 (and the matching removals); auditd for usermod and /etc/group; macOS dseditgroup	Additions to Domain Admins, Enterprise Admins, local Administrators or ESX Admins
T1484.002 Trust Modification	DET0458	Security Event IDs 5136 and 4704, Sysmon Event ID 1; Microsoft 365 "Set federation settings on domain", "Set domain authentication"	Any new trust, federated IdP or change from managed to federated authentication
T1543.003 Windows Service	DET0552	Security Event ID 4697, Sysmon Event IDs 1, 6, 13 and 14	New services with binaries in user-writable paths, and unsigned driver loads
T1548.002 Bypass UAC	DET0388	Security Event IDs 4688 and 4672, Sysmon Event IDs 7, 10, 13 and 14	Registry changes to auto-elevate handler keys followed by a high-integrity child of eventvwr.exe or sdclt.exe
T1134.001 Token Impersonation/Theft	DET0482	Security Event ID 4688, Sysmon Event ID 10, token API telemetry (DuplicateTokenEx, ImpersonateLoggedOnUser)	Non-service processes duplicating SYSTEM or administrator tokens
T1068 Exploitation	DET0514	Sysmon Event IDs 1 and 6, Security Event ID 4672; auditd; containerd runtime events	Vulnerable driver loads, SYSTEM shells spawned from user processes
T1611 Escape to Host	DET0219	Docker daemon events, Kubernetes API server audit (hostPath, privileged securityContext), auditd setns, unshare, mount	Privileged pods or host mounts outside approved namespaces

Metrics that show coverage is working

Standing privilege: number of permanent Global Administrator, Owner and Domain Admin assignments, trending towards zero with just-in-time activation.
Grant detection latency: median time from a privileged role or group assignment to analyst review.
Local admin exposure: share of endpoints where standard users are members of the local Administrators group.
Patch latency for local escalation bugs: median days from vendor release to deployment for kernel and driver vulnerabilities.
Technique test pass rate: share of escalation emulation tests (service creation, UAC bypass, role assignment) that raise an alert within 15 minutes.

Mitigation priorities

Counting "mitigates" relationships in v20 shows which controls touch the most techniques in this tactic. The top of the list is identity governance, not endpoint tooling.

Mitigation	Techniques mapped in TA0004	Practical form
M1018 User Account Management	35	Remove local admin from standard users; scope who can create services, tasks and cloud roles
M1026 Privileged Account Management	31	Tiered administration, just-in-time role activation, separate admin accounts. See the Tiered Administration and Enterprise Access Model Guide.
M1022 Restrict File and Directory Permissions	21	No user-writable paths in service binaries, scripts or autostart locations
M1040 Behavior Prevention on Endpoint	16	EDR blocking for injection, token theft and LSASS access; attack surface reduction rules
M1047 Audit	13	Regular review of services, tasks, role holders and app credentials against a baseline
M1038 Execution Prevention	12	Application control (WDAC, AppLocker) and the vulnerable driver blocklist
M1032 Multi-factor Authentication	11	Phishing-resistant MFA on every privileged role activation
M1028 Operating System Configuration	10	UAC set to always notify for administrators, hardened sudoers, restricted container runtimes

For the full catalogue of mitigations and how they map across tactics, see the ATT&CK Mitigations hub.

Phased rollout

Inventory privileged paths: list Domain Admins, Global Administrators, cloud Owner and IAM admin roles, service principals with high permissions, and users with local admin.
Turn on the logs: Security Event IDs 4697, 4698, 4728, 4732, 4756 and 5136, Sysmon, Microsoft 365 unified audit, Entra ID audit, CloudTrail management events in every region, Kubernetes audit.
Alert on grants first: deploy the identity-plane detections in the table, which have low volume and high value.
Reduce standing privilege: move administrator roles to just-in-time activation. Microsoft Entra Privileged Identity Management supports time-bound assignments, approval, MFA on activation, justification, activation notifications and access reviews.
Harden endpoints in rings: remove local admin rights and enable application control in audit mode, review blocks with application owners, then enforce ring by ring. Keep a documented break-glass path and a per-ring rollback for each policy.
Test: run emulation of the top techniques each quarter and track the pass rate.

Decision guidance

Cloud-first organisations: put identity-plane detection and just-in-time roles ahead of host analytics; a tenant role grant outweighs most endpoint escalations.
Large Windows estates: local admin removal and application control remove more technique paths than any number of UAC bypass detections.
Small teams: rely on EDR for T1055 and T1134, and spend scarce engineering time on the handful of grant and federation alerts that EDR does not see.
Container platforms: enforce Pod Security Standards (restricted) and block privileged pods and hostPath mounts by policy; detection of escape after the fact is hard.

Common failure patterns

Watching hosts, not tenants: EDR coverage is strong while role assignments, app credential additions and federation changes go unalerted.
Standing Global Administrator and Owner roles: any session hijack becomes full control because nothing needs activating.
Users as local administrators: UAC is a convenience boundary, so bypass techniques make escalation trivial.
Service principals with no owner: nobody notices a new secret on an app with directory-wide permissions.
Help desk resets for privileged users: social engineering of support staff delivers admin rights without any technical exploit, as the MGM case shows.
Permissive PassRole and impersonation grants: wildcard Resource values let any developer borrow an administrator role through a service.

Framework mapping

Framework	Relevant references
NIST SP 800-53 Rev. 5	AC-6 Least Privilege, AC-6(5) Privileged Accounts, AC-6(9) Log Use of Privileged Functions, AC-2(7) Privileged User Accounts, AC-2(4) Automated Audit Actions, CM-7 Least Functionality, SI-2 Flaw Remediation, SI-4 System Monitoring
NIST CSF 2.0	PR.AA-05 access permissions managed and reviewed, PR.PS-02 software maintained, DE.CM-03 personnel activity monitored, DE.CM-09 computing environments monitored
CIS Controls v8.1	Control 5 Account Management, Control 6 Access Control Management, Control 7 Continuous Vulnerability Management, Control 8 Audit Log Management
MITRE D3FEND	D3-UAP User Account Permissions, D3-LAM Local Account Monitoring

Practitioner checklist

List every permanent privileged role in directory and cloud, and move each to just-in-time activation with MFA.
Alert on privileged role assignments, group additions, new app credentials and federation or trust changes.
Remove standard users from local Administrators and set UAC to always notify for remaining admins.
Baseline services, scheduled tasks and autostart locations; alert on new entries in user-writable paths (Event IDs 4697, 4698).
Enable the vulnerable driver blocklist and track patch latency for local escalation bugs.
Scope iam:PassRole and service account impersonation to named roles and services.
Block privileged pods and hostPath mounts by admission policy.
Assign an owner to every service principal with high permissions and review its credentials quarterly.
Run quarterly emulation of the top escalation techniques and record the detection pass rate.

ATT&CK Privilege Escalation Tactic: Closing the Paths to Admin and Cloud Owner