Exploitation for Privilege Escalation T1068
Tactic: Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Events covered
27 catalog events are tagged with this technique by at least one rule.
Authoring guide
Patterns shared across the 145 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.
Fields filtered most (151 distinct)
The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.
Top indicator values (6433 distinct)
Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.
Exclusions (310 distinct)
Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.
Rules under this technique
Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.
Sigma 35 rules
- Audit CVE Event
- Buffer Overflow Attempts
- Computer account created with privileges
- Computer account renamed without a trailing $ (CVE-2021-42278/42287)
- Exploiting CVE-2019-1388
- Exploiting SetupComplete.cmd CVE-2019-1378
- HackTool - SysmonEOP Execution
- HKTL - SharpSuccessor Privilege Escalation Tool Execution
- InstallerFileTakeOver LPE CVE-2021-41379 File Create Event
- Kerberos ticket without a trailing $ (CVE-2021-42278/42287)
- Linux Sudo Chroot Execution
- macOS Setuid/Setgid Privilege Escalation
- Malicious Driver Load
- Malicious Driver Load By Name
- Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation
- OMIGOD HTTP No Authentication RCE - CVE-2021-38647
- OMIGOD SCX RunAsProvider ExecuteScript
- OMIGOD SCX RunAsProvider ExecuteShellCommand
- Possible Coin Miner CPU Priority Param
- Potential CVE-2021-41379 Exploitation Attempt
- Potential CVE-2024-35250 Exploitation Activity
- Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)
- Potential Nimbuspwn Exploit CVE-2022-29799 and CVE-2022-27800
- Potential SystemNightmare Exploitation Attempt
- Privilege SeMachineAccountPrivilege abuse
- Process Explorer Driver Creation By Non-Sysinternals Binary
- Process Monitor Driver Creation By Non-Sysinternals Binary
- Sudo Privilege Escalation CVE-2019-14287
- Sudo Privilege Escalation CVE-2019-14287 - Builtin
- Suspicious Kerberos proxiable/S4U2self ticket (CVE-2021-42278/42287)
- Suspicious Spool Service Child Process
- Suspicious Sysmon as Execution Parent
- Vulnerable Driver Load
- Vulnerable Driver Load By Name
- XPC Privilege Escalation Attempt
Elastic 59 rules
- Anomalous Linux Compiler Activity
- Deprecated - Sudo Heap-Based Buffer Overflow Attempt
- Deprecated - Suspicious PrintSpooler Service Executable File Creation
- Expired or Revoked Driver Loaded
- Exploit - Detected - Elastic Endgame
- Exploit - Prevented - Elastic Endgame
- First Time Seen Driver Loaded
- Modification of the msPKIAccountCredentials
- Persistence via Update Orchestrator Service Hijack
- Potential Buffer Overflow Attack Detected
- Potential Copy Fail (CVE-2026-31431) Exploitation via AF_ALG Socket
- Potential CVE-2025-32463 Nsswitch File Creation
- Potential CVE-2025-32463 Sudo Chroot Execution Attempt
- Potential CVE-2025-41244 vmtoolsd LPE Exploitation Attempt
- Potential Escalation via Vulnerable MSI Repair
- Potential privilege escalation via CVE-2022-38028
- Potential Privilege Escalation via CVE-2023-4911
- Potential Privilege Escalation via Enlightenment
- Potential Privilege Escalation via InstallerFileTakeOver
- Potential Privilege Escalation via Linux DAC permissions
- Potential Privilege Escalation via PKEXEC
- Potential Privilege Escalation via Python cap_setuid
- Potential Privilege Escalation via Recently Compiled Executable
- Potential Privilege Escalation via SUID/SGID Proxy Execution
- Potential Privilege Escalation via unshare and UID Change
- Potential Privilege Escalation via unshare Followed by Root Process
- Potential Privileged Escalation via SamAccountName Spoofing
- Potential Shadow File Read via Command Line Utilities
- Potential Shell via Wildcard Injection Detected
- Potential snap-confine Privilege Escalation via CVE-2026-3888
- Potential Sudo Privilege Escalation via CVE-2019-14287
- Potential Telnet Authentication Bypass (CVE-2026-24061)
- Potential Unauthorized Access via Wildcard Injection Detected
- Privilege Escalation via CAP_CHOWN/CAP_FOWNER Capabilities
- Privilege Escalation via CAP_SETUID/SETGID Capabilities
- Privilege Escalation via GDB CAP_SYS_PTRACE
- Privilege Escalation via SUID/SGID
- Remote Computer Account DnsHostName Update
- Root Network Connection via GDB CAP_SYS_PTRACE
- Spike in Group Application Assignment Change Events
- Spike in Group Lifecycle Change Events
- Spike in Group Membership Events
- Spike in Group Privilege Change Events
- Spike in host-based traffic
- Spike in Special Logon Events
- Spike in Special Privilege Use Events
- Spike in User Account Management Events
- Suspicious Child Process of Adobe Acrobat Reader Update Service
- Suspicious Passwd File Event Action
- Suspicious Print Spooler File Deletion
- Suspicious Print Spooler Point and Print DLL
- Suspicious Print Spooler SPL File Created
- Telnet Authentication Bypass via User Environment Variable
- Unsigned DLL loaded by DNS Service
- Unusual Executable File Creation by a System Critical Process
- Unusual Group Name Accessed by a User
- Unusual Print Spooler Child Process
- Unusual Privilege Type assigned to a User
- Unusual Spike in Concurrent Active Sessions by a User
Splunk 32 rules
- Child Processes of Spoolsv exe
- Cisco Isovalent - Kprobe Spike
- Consent.exe Suspicious Child Process (Sysmon)
- Consent.exe Suspicious Child Process (Windows Event Log)
- Detect Baron Samedit CVE-2021-3156
- Detect Baron Samedit CVE-2021-3156 Segfault
- Detect Baron Samedit CVE-2021-3156 via OSQuery
- Driver as Command Parameter (Windows Event Log)
- Driver Loaded from Unusual Path - Windows (Sysmon)
- Executable Running as NT AUTHORITY_SYSTEM Registered in BAM (Sysmon)
- Executable Running as NT AUTHORITY_SYSTEM Registered in BAM (Windows Event Log)
- First Time Seen Child Process of Zoom
- Kernel Service Installed - Windows (Windows Event Log)
- Linux Auditd Copy Fail Privilege Escalation
- Linux pkexec Privilege Escalation
- Microsoft SharePoint Server Elevation of Privilege
- Spoolsv Suspicious Process Access
- Suspicious .sys Created - Windows (Sysmon)
- VMWare Aria Operations Exploit Attempt
- Windows Driver Inventory
- Windows Driver Load Non-Standard Path
- Windows Drivers Loaded by Signature
- Windows MSI Rollback Script Deleted By Non-Msiexec Process
- Windows Potato Privilege Escalation Tool Execution
- Windows Privilege Escalation Attempt Via MSI Rollback
- Windows Privilege Escalation Suspicious Process Elevation
- Windows Privilege Escalation System Process Without System Parent
- Windows Privilege Escalation User Process Spawn System Process
- Windows Remote Image Load
- Windows Service Create Kernel Mode Driver
- Windows System File on Disk
- ZeroLogon CVE-2020-1472 (Windows Event Log)
Kusto 16 rules
- CTERA Mass Permissions Changes Detection Analytic
- Detect CVE exploits on network for which a device is vulnerable
- Detect LolDriver drop or load from unknown or unsigned process
- Dynatrace Application Security - Attack detection
- Email access via active sync
- GitHub Security Vulnerability in Repository
- Google DNS - CVE-2020-1350 (SIGRED) exploitation pattern
- Google DNS - CVE-2021-34527 (PrintNightmare) external exploit
- Google DNS - CVE-2021-40444 exploitation
- McAfee ePO - Threat was not blocked
- Power Platform - Account added to privileged Microsoft Entra roles
- Powershell Empire Cmdlets Executed in Command Line
- Rare application consent
- Semperis DSP Zerologon vulnerability
- Silverfort - Certifried Incident
- Silverfort - NoPacBreach Incident