What Is Privilege Escalation? How Attackers Gain Admin Access

Types of Privilege Escalation

Vertical Privilege Escalation

Vertical privilege escalation is the gain of higher-level permissions than originally granted — a standard user account gaining administrator-level access, or a local administrator account gaining domain administrator rights. This is the form that matters most in breach scenarios because it is what converts a compromised low-privilege account into the domain-wide control needed for ransomware deployment, mass data exfiltration, or persistent backdoor installation.

The most impactful vertical escalation targets in Windows environments are domain administrator, local administrator on a large number of machines, and accounts with Azure or Microsoft 365 Global Administrator roles. An attacker who achieves any of these has effectively won — the environment is compromised at a scope that cannot be remediated without understanding and evicting every persistence mechanism they have established.

Horizontal Privilege Escalation

Horizontal privilege escalation is the use of one account's privileges to access resources that a different account at the same privilege level can access. An attacker who compromises a finance employee's account and uses those credentials to access another finance employee's email, files, or systems is escalating horizontally. This is the form most relevant to insider threat scenarios and data theft operations where the attacker wants breadth of access within a specific data category rather than administrative control.

The Most Common Privilege Escalation Techniques

Kerberoasting

Kerberoasting targets Active Directory service accounts. Any domain-authenticated user can request a Kerberos service ticket for any account registered with a Service Principal Name — and those tickets are encrypted using the service account's password hash. The attacker requests the ticket, captures it, and cracks the encryption offline. Service accounts with weak passwords — common because service accounts are often configured once and never rotated — yield to GPU-accelerated cracking in minutes or hours, producing credentials with the service account's typically elevated permissions.

Token Impersonation and Pass-the-Token

Windows access tokens represent the security context of a running process. An attacker with code execution on a system can attempt to impersonate tokens belonging to higher-privileged processes or logged-in users. The SeImpersonatePrivilege — a Windows privilege held by many service accounts — enables token impersonation attacks that can escalate a service account compromise to SYSTEM-level access on the local machine.

Misconfigured Sudo and Overprivileged Service Accounts

In Linux and cloud environments, privilege escalation commonly exploits misconfigured sudo permissions that grant users the ability to run specific commands as root, misconfigured SUID binaries that execute with the permissions of the file owner rather than the executing user, and cloud IAM misconfigurations that grant service accounts or Lambda functions more permissions than their function requires. In AWS, Azure, and GCP environments, privilege escalation through IAM misconfigurations is one of the most common cloud security findings — because cloud IAM is complex, least-privilege is hard to maintain as environments grow, and auditing for overprivilege is rarely part of routine operations.

How Attackers Use Privilege Escalation in Practice

Privilege escalation is rarely the attacker's objective — it is the enabler of their objective. The sequence is consistent: initial access through phishing or credential theft, lateral movement to identify escalation opportunities, privilege escalation to gain the permissions needed for the actual objective, and then the objective itself — ransomware deployment, data exfiltration, persistent access establishment.

The critical decision point for breach scope is the privilege level the attacker achieves before detection. An attacker contained at standard user privileges can access what that user can access. An attacker who escalates to domain administrator before detection can access everything, can create persistent backdoor accounts that survive password resets, can exfiltrate the Active Directory database containing all credential hashes, and can deploy ransomware across the entire domain simultaneously.

Privilege Escalation in Cloud Environments

Cloud environments introduce privilege escalation pathways that do not exist in traditional on-premises networks — and that are less well understood by most security teams. In AWS, an attacker with access to an IAM role that can assume other roles, modify IAM policies, or access EC2 instance metadata can escalate to administrative permissions through chains of intermediate permissions that individually appear low-risk. In Azure, Contributor role at the subscription level provides the ability to create new privileged role assignments, effectively enabling escalation to Owner. In both environments, misconfigured service principals, instance metadata service access, and overprivileged Lambda/Function execution roles are common escalation pathways documented in red team engagements.

Preventing and Detecting Privilege Escalation

Privilege escalation prevention centers on eliminating the misconfigurations and over-permissions that escalation techniques exploit. Least-privilege access — granting every user account, service account, and system the minimum permissions required for its specific function — removes the escalation targets that attackers use. This requires regular privilege review cycles, not one-time configuration at onboarding.

Service account hygiene addresses Kerberoasting: service accounts should have long, randomly generated passwords that are rotated regularly, managed service accounts (gMSAs) should be used where possible to automate rotation, and SPNs should be assigned only to accounts that genuinely require them. These changes do not prevent Kerberoasting attempts — they make the resulting tickets computationally infeasible to crack.

Privileged Access Workstations (PAWs) limit the environments where administrative credentials are used — reducing the attack surface for credential dumping from systems where administrators are logged in. Combining PAW controls with tiered administrative accounts, where domain administrator credentials are never used on internet-connected workstations, eliminates the most common pathways to domain administrator compromise through credential theft.

Detection of privilege escalation requires monitoring for the specific activities that indicate escalation attempts: Kerberoasting ticket requests (volume of TGS requests for SPN-registered accounts), LSASS memory access by unexpected processes, new local administrator accounts created outside normal provisioning workflows, and anomalous role assignments in cloud IAM. These are specific, monitorable events that a properly configured SIEM or identity threat detection platform surfaces clearly.

Related Reading

• Lateral Movement
• Identity and Access Management (IAM)
• Incident Response

What is privilege escalation?

Privilege escalation is the technique attackers use to gain higher-level permissions on a system than the access they initially had. An attacker who compromises a standard user account but needs administrator access to install persistence mechanisms or access sensitive data uses privilege escalation techniques to expand their access. There are two main categories: vertical privilege escalation (gaining higher-level privileges, e.g., user to admin) and horizontal privilege escalation (gaining the same privilege level on a different account, e.g., compromising another user's account).

What are the main privilege escalation techniques?

Exploitation of unpatched local privilege escalation vulnerabilities (CVE-2024-0001 type bugs in Windows kernel, Linux kernel, or system services that allow standard users to gain SYSTEM privileges). Credential theft from process memory (Mimikatz extracting hashes and tickets from LSASS to use for authentication as other users). Token manipulation (impersonating tokens of higher-privileged processes). Abuse of misconfigured services (services running as SYSTEM but writeable by standard users). DLL hijacking (placing malicious DLLs in locations where privileged processes will load them). Bypass of User Account Control (UAC) protections.

What is vertical vs horizontal privilege escalation?

Vertical privilege escalation gains higher-level permissions — standard user to local admin, local admin to SYSTEM, domain user to domain admin. Horizontal privilege escalation gains the same privilege level on a different account or system — one standard user accessing another standard user's data. Vertical is typically the goal in technical attacks; horizontal is common in insider threats and data theft scenarios where the attacker wants access to a specific person's resources.

How is privilege escalation detected?

EDR with behavioral detection identifies the activity patterns associated with privilege escalation — unusual process privilege changes, LSASS memory access from non-standard processes, token manipulation attempts, exploitation of known privilege escalation CVEs. Windows Event Logs capture privilege use events (4672) and special privilege assignments. SIEM correlation across endpoint and identity sources identifies privilege escalation chains that span multiple systems.

What is the most common privilege escalation method?

Credential theft is the dominant method. Attackers who compromise an endpoint typically use Mimikatz or similar tools to extract cached credentials, password hashes, and Kerberos tickets from process memory. They then authenticate to other systems or services using those credentials. If they extract a privileged credential (administrator, service account with elevated access), they have effectively achieved privilege escalation through credential theft rather than vulnerability exploitation.

How can privilege escalation be prevented?

Patch management closes known privilege escalation vulnerabilities. Endpoint hardening (UAC enforcement, Credential Guard, Local Security Authority protection) makes credential theft harder. Privileged Access Management restricts where administrative credentials can be used. Tiered administration models (separate accounts for administrative and standard tasks; no admin credentials used for daily work) limit the damage when a user account is compromised. Application allowlisting prevents unauthorized privilege escalation tools from running. The principle of least privilege — minimum access needed for the role — reduces the value of any single credential compromise.

What is the relationship between privilege escalation and ransomware?

Modern ransomware operations almost always require privilege escalation. Initial access provides only standard user privileges. Encrypting the maximum number of systems requires administrative or domain-level access. Disabling backups requires privileged access to backup infrastructure. Deploying ransomware across an environment requires lateral movement supported by appropriate credentials. The investment attackers make in privilege escalation between initial access and ransomware deployment is what creates the multi-week dwell time observed in major ransomware incidents.

Kerberoasting to Domain Admin: A Documented Attack Chain

In a 2024 incident response engagement, Cloudskope traced a ransomware event to an attack chain that began with a phishing email to a non-technical employee, continued through Kerberoasting, and ended in domain administrator compromise. The attacker gained initial access through a credential captured by an AiTM phishing page. The compromised account was a standard user with no administrative privileges. Using that account, the attacker ran a Kerberoasting request against the domain and captured service tickets for 23 service accounts. Offline cracking of those tickets — completed within 6 hours using GPU acceleration — produced 4 valid service account credentials. Two of those service accounts had local administrator rights on production servers. From a production server, the attacker dumped credentials from LSASS memory and obtained a domain administrator hash. Total time from initial phishing click to domain administrator access: 14 hours. Detection: zero alerts generated. The environment had CrowdStrike deployed in default configuration.