What is privilege escalation?
Privilege escalation is how an attacker turns a limited foothold into the access they actually want. Running code or holding a low-level account is rarely the goal by itself; it is the step between being on a system and controlling it. The attacker exploits a flaw, a misconfiguration or excess rights to operate with privileges they were never granted.
Vertical and horizontal escalation
Escalation is described by its direction.
| Direction | What the attacker gains | Example |
|---|---|---|
| Vertical | A higher privilege level than the account started with | Standard user to administrator; local user to root or SYSTEM |
| Horizontal | Another user's data or functions at the same level | Editing an invoice number in a URL to open someone else's invoice |
Vertical is the classic sense of the term. The attacker moves up across a trust boundary and picks up powers that never belonged to them, typically by exploiting a kernel bug, a misconfigured service that runs under a powerful account, or weak permissions on a file or registry key.
Horizontal escalation adds no new powers; the attacker simply operates as a different peer. The textbook case is an insecure direct object reference (IDOR). The application puts a record identifier, such as an invoice number, in the URL and never confirms that the signed-in user is allowed to view that record. Change ?invoice=10431 to 10432, see another customer's invoice, and you have escalated horizontally. Hiding the identifier does not fix this; checking authorization on every object request does.
Indicators of escalation
Evidence turns up in logs and in the state of the system:
- a standard account that starts carrying out administrative tasks
- a new member in a privileged group; on Windows, event ID 4732 is logged when a member is added to a security-enabled local group
- a process running as SYSTEM or root that has no business doing so
- a service account doing things far outside its normal job
Investigators spot escalation by tying an earlier low-privilege compromise to a high-privilege action that came after it.
How to defend against it
Least privilege does most of the work. Each account and service should hold only the rights its job requires, local administrator rights should be removed wherever that is practical, and elevation should be granted just in time instead of permanently. Patching operating systems and services shuts known escalation routes, kernel flaws included. Regularly audit sudo rules, SUID binaries, service accounts and file permissions, and watch for the indicators above so an attempt is spotted quickly.
Privilege escalation on the CompTIA Security+ exam
Privilege escalation is an indicator of malicious activity under objective 2.5. Sort each scenario by direction: more power than the account began with means vertical, and access to another user's equivalent data means horizontal, usually by way of an insecure direct object reference. Scenario wording about a standard user gaining admin rights, or a user viewing another customer's record by changing a parameter, points here. When a question asks how to contain the harm once a system has been compromised, least privilege and prompt patching are the best answers.