Privilege Escalation
Privilege escalation techniques allow adversaries to obtain higher-level permissions in your environment — moving from a limited foothold to full administrative access. Early detection limits blast radius before attackers reach critical systems.
Coverage
- Techniques covered
- 13
- Detection rules
- 52
- Cloud-specific rules
- 28
Threat context
How adversaries escalate privileges
In cloud environments, privilege escalation is often a sequence of seemingly-benign API calls. An attacker with iam:AttachRolePolicy can grant themselves any permission. With iam:CreateAccessKey they can create credentials for a more powerful user. With sts:AssumeRole they can pivot through role chains to reach administrator-level access. None of these individually look suspicious without the full context of who is calling them and why.
ManySignal's entity graph tracks the full chain of permission changes, correlating the identity performing the action with their baseline behaviour, the time of day, the source IP, and the downstream actions that follow. This context is what transforms a routine IAM API call into a high-confidence privilege escalation alert.
Techniques
Privilege Escalation techniques ManySignal detects
Abuse Elevation Control Mechanism
UAC bypass, sudo abuse, and cloud temporary elevated access.
Exploitation for Privilege Escalation
CVE exploitation targeting kernel drivers, SUID binaries, or cloud metadata services.
Access Token Manipulation
Token impersonation, duplicate tokens, and cloud role chaining.
Account Manipulation
Adding cloud roles or group memberships to escalate permissions.
Domain or Tenant Policy Modification
Modifying Azure tenant or Active Directory domain policies to grant elevated permissions.
Escape to Host
Container breakout to gain host-level privileges in Kubernetes environments.
Privilege Escalation: frequently asked questions
What is ATT&CK Privilege Escalation (TA0004)?
Privilege Escalation covers techniques adversaries use to gain higher-level permissions than initially obtained. In cloud environments, this often means escalating from a standard IAM user to an admin role through role chaining or policy modification.
What are the most common cloud privilege escalation paths?
Common cloud privilege escalation paths include: assuming a role with broader permissions via STS AssumeRole, attaching admin policies to a compromised principal, creating new access keys for privileged users, and exploiting EC2 instance metadata to retrieve instance role credentials.
How does ManySignal detect privilege escalation in real time?
ManySignal monitors IAM policy changes, role assumption patterns, group membership changes, and PIM activation events. Anomalous privilege changes (wrong actor, unusual time, unexpected role) trigger alerts within minutes.
Does privilege escalation always follow initial access?
Not always. When attackers obtain credentials for an already-privileged account, they may skip privilege escalation and proceed directly to their objective. However, many phishing and credential stuffing attacks succeed against lower-privilege accounts, requiring escalation.
Stop privilege escalation before attackers reach admin
ManySignal correlates IAM events, group changes, and role assumptions to detect escalation paths before they reach your most sensitive systems.