Privilege Escalation
0 confirmed incidents.
VERIS: hacking:Exploit vulnMITRE ATT&CK: T1548 (Abuse Elevation Control Mechanism)T1134 (Access Token Manipulation)T1547 (Boot or Logon Autostart Execution)
MITRE ATT&CK technique names and ids on this page are reproduced and distributed with the permission of The MITRE Corporation. © 2015–2026, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
Privilege escalation covers an attacker who already has some foothold on a system using a technique to gain higher-level permissions than the account it first compromised was supposed to have. It maps to three MITRE ATT&CK techniques: T1548 (Abuse Elevation Control Mechanism), bypassing a system's own controls for granting elevated rights; T1134 (Access Token Manipulation), forging or stealing a security token that carries another account's permissions; and T1547 (Boot or Logon Autostart Execution), planting code that runs automatically with higher privileges the next time the system starts or a user logs in.
No confirmed incidents currently carry this attack-type classification.
Questions and answers
How many confirmed incidents are classified as Privilege Escalation on Breach Census?
0 confirmed incidents are currently classified as Privilege Escalation.
Which MITRE ATT&CK techniques does the Privilege Escalation classification cover?
This classification maps to MITRE ATT&CK techniques T1548 (Abuse Elevation Control Mechanism), T1134 (Access Token Manipulation), T1547 (Boot or Logon Autostart Execution).
What counts as a confirmed incident for the Privilege Escalation classification?
An incident counts here once it carries the Privilege Escalation attack-type classification and has reached the confirmed status described on the Methodology page; a bare claim or press report is not enough.