Privilege escalation is the act of gaining higher access rights than originally granted – for example turning a normal user account into administrator or root.
How privilege escalation works
- Vertical escalation raises rights: from a user to administrator, from an app to the operating system kernel.
- Horizontal escalation gives access to another account with the same level, such as reading another customer’s data in a web app.
Attackers escalate through kernel and driver bugs (Dirty Pipe, CVE-2022-0847, on Linux), flaws in privileged services (PrintNightmare in the Windows print spooler), misconfigured sudo rules and file permissions, stored or reused admin passwords, and weaknesses in Active Directory. Microsoft calls this bug class “elevation of privilege” (EoP), and it appears in almost every monthly Patch Tuesday.
Why privilege escalation matters for security
An initial foothold – a phished laptop or a compromised web server – usually runs with limited rights. To disable security tools, dump credentials, install a rootkit or deploy ransomware across a network, attackers need administrator or SYSTEM access. That is why local privilege escalation exploits are chained with remote ones and are a standard step before lateral movement.
How to defend
- Apply the principle of least privilege: no daily work with admin accounts, separate admin workstations.
- Patch operating systems and drivers promptly; block known vulnerable drivers.
- Use unique local admin passwords (Windows LAPS) and remove unnecessary sudo and service rights.
- Monitor for new admin group members, suspicious token manipulation and disabled security software.
