Privilege escalation is the technique an attacker uses to gain elevated permissions — from standard user to local admin, from local admin to SYSTEM, or from a service account to Domain Admin. Every post-exploitation phase depends on it. Catching it early stops the attacker before they reach critical systems.
Most escalation techniques leave specific process lineage signatures — a medium-integrity process spawning a high-integrity child, UAC bypass patterns in the registry or filesystem, or a service binary being replaced. This SOP focuses on those signatures.
◈ Table of Contents
01
Background
CONTEXTB1Attack Techniques & MITRE Mapping
| Technique | MITRE | Key Signal | Severity |
|---|---|---|---|
| UAC Bypass (fodhelper, eventvwr, sdclt) | T1548.002 | Auto-elevated process from non-elevated parent; registry HKCU shell hijack | HIGH |
| Token Impersonation / Potato attacks | T1134.001 | SeImpersonatePrivilege on non-service account; JuicyPotato / RoguePotato process chain | CRITICAL |
| Service binary / DLL hijacking | T1574.010 | Service binary in user-writable path; DLL written to app directory before service restart | HIGH |
| Scheduled task abuse | T1053.005 | Task running as SYSTEM created by non-admin account; action = cmd /c or powershell | HIGH |
| Kernel exploit | T1068 | Known CVE exploit binary; process elevation without UAC prompt; SYSTEM shell from user context | CRITICAL |
| sudo / SUID abuse (Linux) | T1548.003 | Unexpected sudo usage; SUID binary exec from non-standard path | HIGH |
B2Log Sources & Severity Scale
| Source | Table / Index | Key Events |
|---|---|---|
| Defender for Endpoint | DeviceProcessEvents, DeviceEvents, DeviceRegistryEvents | ProcessIntegrityLevel, InitiatingProcessIntegrityLevel, TokenElevationType |
| Windows Security Log | SecurityEvent | 4672 (Special privileges assigned), 4674 (Privilege use), 4688 (Process create with elevation) |
| Sysmon | index=sysmon EventCode 1, 11, 13 | IntegrityLevel field in Event 1; registry writes to UAC bypass keys (Event 13) |
| Severity | Condition |
|---|---|
| MEDIUM | UAC bypass on standard workstation, no follow-on payload detected, single occurrence |
| HIGH | Admin token obtained, persistence established, or escalation on a server/jump box |
| CRITICAL | SYSTEM obtained via kernel exploit, Domain Admin token stolen, DC targeted |
02
Identification
INVESTIGATEInvestigation Workflow
I1Alert Triage ChecklistFirst 5 Min
- 1Is the process running with SYSTEM or High integrity level when launched from a Medium-IL parent? That's the core signal.
- 2Does the parent process make sense for the elevated child? (explorer.exe → cmd.exe High IL = suspicious; services.exe → svchost.exe High IL = normal)
- 3Is there a known UAC bypass registry key written? (HKCU\Software\Classes\ms-settings\shell\open\command or similar)
- 4Was the escalation followed by credential dumping, lateral movement, or persistence within the same time window?
- 5Is this device a server, domain controller, or privileged workstation? Severity jumps immediately.
I2Process Integrity Level Anomaly DetectionKQL + SPL
KQL — Defender Advanced Hunting
// Medium-IL parent spawning High-IL child (UAC bypass signature)
DeviceProcessEvents
| where Timestamp > ago(2h)
| where DeviceName == "DEVICE_NAME"
| where ProcessIntegrityLevel == "High"
| where InitiatingProcessIntegrityLevel in ("Medium", "Low")
// Exclude expected system escalations
| where InitiatingProcessFileName !in~ (
"services.exe", "wininit.exe", "lsass.exe", "smss.exe", "csrss.exe"
)
| project Timestamp, DeviceName, FileName, ProcessCommandLine,
ProcessIntegrityLevel, InitiatingProcessFileName,
InitiatingProcessIntegrityLevel, AccountName
| order by Timestamp asc
SPL — Splunk (Sysmon Event 1)
index=sysmon EventCode=1 IntegrityLevel=High
| where ParentIntegrityLevel="Medium" OR ParentIntegrityLevel="Low"
| where NOT (ParentImage IN ("*\\services.exe","*\\wininit.exe","*\\lsass.exe"))
| table _time, host, Image, CommandLine, IntegrityLevel,
ParentImage, ParentCommandLine, User
| sort _time
I3UAC Bypass Registry Key DetectionKQL + SPL
KQL — Registry write to UAC bypass key
// UAC bypass via registry hijack (fodhelper, eventvwr, sdclt pattern)
DeviceRegistryEvents
| where Timestamp > ago(24h)
| where ActionType == "RegistryValueSet"
| where RegistryKey has_any (
"ms-settings\\shell\\open\\command",
"mscfile\\shell\\open\\command",
"ms-settings\\CurVer",
"Software\\Classes\\ms-settings"
)
| project Timestamp, DeviceName, RegistryKey, RegistryValueName,
RegistryValueData, InitiatingProcessFileName,
InitiatingProcessCommandLine, AccountName
SPL — Sysmon Event 13 (Registry value set)
index=sysmon EventCode=13
(TargetObject="*ms-settings\\shell\\open\\command*"
OR TargetObject="*mscfile\\shell\\open\\command*")
| table _time, host, TargetObject, Details, Image, User
| sort _time
I4FP vs TP Decision Gate
| Signal | Verdict |
|---|---|
| High-IL process from Medium-IL parent + UAC bypass registry key | TP — HIGH. Escalate to L2. |
| SYSTEM shell spawned from user-context process | TP — CRITICAL. Isolate immediately. |
| SeImpersonatePrivilege assigned to non-service account (Event 4672) | TP — HIGH. Token abuse in progress. |
| IT admin running autorized UAC prompt on their own device | FP — confirm with admin, close. |
| Pen test tool on authorized assessment device | FP — confirm scope, document, close. |
| Elevation followed by credential dump (procdump lsass, mimikatz) | TP — CRITICAL. Cross-reference SOP-03. |
03
Containment
STOP ITC1Kill Elevated Process & Isolate DeviceImmediate
- 1Open Live Response:
security.microsoft.com → Assets → Devices → [device] → Initiate Live Response - 2Kill the elevated process:
run taskkill /F /PID [PID_of_elevated_process] - 3If SYSTEM shell is confirmed active — isolate the device immediately:
Device page → Isolate device → Full isolation - 4If UAC bypass used a registry key — clean it via Live Response:
run reg delete "HKCU\Software\Classes\ms-settings\shell\open\command" /f
C2Account Containment — Entra ID
- 1Block sign-in:
portal.azure.com → Entra ID → Users → [user] → Account enabled → NO - 2Revoke all sessions:
Users → [user] → Revoke sessions - 3Reset password via out-of-band channel to user's manager — not email.
- 4If the escalated process accessed LSASS or ran mimikatz — treat all accounts with active sessions on that device as compromised. Force password reset for all. Cross-reference SOP-03 (Malware/EDR) and SOP-06 (Lateral Movement).
04
Eradication
CLEAN UPE1Remove Exploit Artifacts & Verify Clean State
- 1Remove UAC bypass registry keys (confirmed in I3). Remove any malicious service binary or DLL from its path.
- 2Check for scheduled tasks created by the elevated process:
run scheduledtasksin Live Response — remove any tasks created during the attack window. - 3If a kernel exploit was used — patch the CVE. Check CISA KEV and vendor advisory for the specific exploit binary. Deploy patch via Intune or WSUS before restoring device to network.
- 4Re-run I2 KQL on a 1-hour window post-cleanup. Expected result: zero Medium→High IL escalations from non-system parents.
Eradication Complete When
- No new elevated processes from unexpected parents in last 1h
- UAC bypass registry keys removed and confirmed absent
- Malicious service binary / DLL removed from disk
- Exploit CVE patched or mitigated
- All sessions for affected accounts revoked and passwords reset
05
Escalation
TIERSESC1Escalation Tiers
| Tier | Trigger | Action |
|---|---|---|
| L1 → L2 | TP confirmed, admin token obtained, or cannot determine FP/TP in 30 min | Hand off with: device name, account, process chain, technique identified, containment status |
| L2 → L3 / IR | SYSTEM obtained via kernel exploit, credential dump confirmed, lateral movement started, server targeted | IR Team takes forensic lead. Do not reimage before evidence collection. |
| L3 → CISO | Domain Admin obtained, DC targeted, Active Directory compromise suspected | CISO notification, potential krbtgt reset, cross-reference SOP-05 (Ransomware) and SOP-06 (Lateral Movement) |
Authored by Rudra Verma | Senior Security Architect | CyberHawk Consultancy. Full SOC SOP library at app.cyberhawkthreatintel.com.
◈ Stay Connected
Follow CyberHawk Threat Intel for SOC SOPs, threat intelligence, and hands-on analyst tooling.
"They can't exploit you if you are the Exploit."