Privilege Escalation

What it is

Privilege escalation gains capabilities beyond those initially available. Vertical escalation moves toward more powerful roles, such as administrator; horizontal access violations reach another user's resources at a similar role level. The cause can be a software flaw, unsafe configuration, or incorrect authorization rather than a stolen administrator password.

How it works

An attacker starts with a limited account or process and exploits a permission gap. Examples include overly broad service roles, writable privileged components, or vulnerable operating-system code. The new capabilities can enable security-control changes, access to secrets, or movement to additional systems.

How people get tricked

Routine services receive more authority than they need, and valid accounts are assumed to be safe. A low-risk initial compromise can be underestimated when its path to higher privilege is not examined.

Example scenario

A compromised ordinary service can modify a file later executed by a privileged task. The attacker uses that trust relationship to gain capabilities the service should not have had.

Warning signs

• Unexpected role changes or additions to privileged groups.
• Unusual privileged execution from ordinary accounts.
• Security settings or protected files change without approved administration.

If it happens to you

Revoke unauthorized privilege, investigate the enabling weakness, and determine what was reachable at the elevated level. Rotate exposed privileged secrets and inspect persistence. Restore a trusted state rather than only returning the visible account to its old role.