Future TechnologyWhat A Privilege Escalation Attack Actually Is, And Why It Keeps Happening
Key takeaways
- A privilege escalation attack is the step that turns a small foothold into full control of a machine, and it appears in almost every serious intrusion
- It scores lower than remote code execution because the attacker has to already be on the machine, which understates how routinely the two get chained together
- The practical defence is unglamorous: patch, do not run as administrator day to day, and watch for unexpected SYSTEM-level activity instead of waiting on a fix
Almost every serious intrusion has the same shape. Someone gets code running on a machine as an ordinary user, then finds a way to become the machine. That second step is a privilege escalation attack, and it is the reason a bug rated medium severity can end with your files encrypted.
What a privilege escalation attack actually is
Computers separate accounts by what they are allowed to do. Your everyday account can open a browser and save a document. It cannot read another user account's files, install a driver, or switch off the security software. On Windows the top of that ladder is SYSTEM, an account with more authority than the administrator you log in as. On Linux and macOS the equivalent is root.
A privilege escalation attack is any trick that moves an attacker up that ladder without a password. Usually it exploits something that already runs with high privileges: a driver, a background service, an installer, or, in the case of the ShieldBreak flaw in Microsoft Defender, the antivirus engine itself.
Why it is not the same as remote code execution
Remote code execution is the front door. An attacker sends something across the network and lands code on your machine without touching it first. Privilege escalation is what happens once they are already inside, which is why severity scoring marks it lower.
That scoring is technically correct and practically misleading, because attackers chain bugs. A phishing payload gets them a normal user session. A local escalation turns that session into ownership of the host. MITRE tracks privilege escalation as its own tactic in ATT&CK precisely because it is a standing step in real intrusions rather than an edge case, and the Lazarus group's Windows zero day earlier this month followed that shape exactly.
Why these bugs keep happening
Modern operating systems run an enormous amount of code at high privilege: graphics drivers, print spoolers, update services, virtualisation layers, security agents. Every one of them accepts input from lower-privileged code, and every place that boundary gets crossed is a chance to get it wrong.
Patches also produce new bugs. ShieldBreak is a bypass of Microsoft's own fix for an earlier flaw, which happens often enough that researchers routinely go looking for it. Closing the specific path an exploit used is much easier than fixing the class of mistake underneath it.
Does this affect you, and what should you do
If you look after one computer
Install updates. Stop using an administrator account for everyday work; create a standard account and use that instead. Leave your security software running, even in the odd cases where it is part of the problem, because it still blocks the step that would get an attacker onto the machine in the first place.
If you look after machines for other people
Assume any attacker with a foothold can reach SYSTEM on an unpatched host, and build detection around the escalation rather than the entry: unexpected processes running as SYSTEM, new services, scheduled tasks created outside a change window. Tighten local administrator group membership.
Then confirm your backups actually restore, because escalation is the step immediately before ransomware gets deployed. Our 3-2-1 backup rule guide covers the part most people skip.