T1068 Exploitation for Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. MITRE ATT&CK

1 program on CmdID 14 Sigma rules T1068 on attack.mitre.org

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

criticalExploiting CVE-2019-1388Florian Roth (Nextron Systems) · Windows

criticalHackTool - SysmonEOP ExecutionFlorian Roth (Nextron Systems) · Windows

criticalPotential CVE-2021-41379 Exploitation AttemptFlorian Roth (Nextron Systems) · Windows

criticalPotential SystemNightmare Exploitation AttemptFlorian Roth (Nextron Systems) · Windows

highExploiting SetupComplete.cmd CVE-2019-1378Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro · Windows

highHKTL - SharpSuccessor Privilege Escalation Tool ExecutionSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

highOMIGOD SCX RunAsProvider ExecuteScriptRoberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC · Linux

highOMIGOD SCX RunAsProvider ExecuteShellCommandRoberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC · Linux

highSudo Privilege Escalation CVE-2019-14287Florian Roth (Nextron Systems) · Linux

highSuspicious Spool Service Child ProcessJustin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule) · Windows

highSuspicious Sysmon as Execution ParentFlorian Roth (Nextron Systems), Tim Shelton (fp werfault) · Windows

lowLinux Sudo Chroot ExecutionSwachchhanda Shrawn Poudel (Nextron Systems) · Linux