MITRE ATT&CK detection coverage

← Back to main site

Home/ MITRE Matrix/ Privilege Escalation/ T1068

T1068Exploitation for Privilege Escalation

T1068 — Exploitation for Privilege Escalation is a MITRE ATT&CK technique in the Privilege Escalation tactic. Clankerusecase tracks 71 detection use cases covering it and 11 threat-intel articles citing it.

Privilege Escalation

View on the matrix → Filter Detection Library MITRE official spec ↗

71Use cases

11Articles

0Sub-techniques

1Tactic

Use cases covering this technique (71)

[WEEKLY] Auth-Bypass on Public-Facing Service → Post-Exploit Action on Same Host (≤10 min) Internal exploit · alerting DSPDD [WEEKLY] Language-runtime server (node/python/java) spawns OS shell shortly after inbound request — eval / sandbox-escape exploitation chain Internal exploit · alerting DSPDD [WEEKLY] Linux LPE chain — anomalous algif_aead/esp4/esp6/rxrpc kernel-module load followed by same-user root transition Internal exploit · alerting DSPDD [WEEKLY] Post-Auth Privilege Boundary Crossing on Edge/Management Appliances (low-priv -> admin within 10m) Internal exploit · alerting DSPDD [WEEKLY] Public-Facing App Runtime Spawns Shell, LOLBin, or Container-Control Tool Internal exploit · alerting DSΣPDD [WEEKLY] Sub-admin grants Owner/Administrator role then grantee signs in from a different source within 60 minutes Internal exploit · alerting DSPDDCW [WEEKLY] Web App Interpreter (Node/Python/Java/PHP) Spawns Shell or Net-Download LOLBin on Internet-Facing Host Internal exploit · alerting DSPDD Child Processes of Spoolsv exe ESCU actions · alerting P Cisco Isovalent - Kprobe Spike ESCU actions · hunting P Detect Baron Samedit CVE-2021-3156 ESCU actions · alerting P Detect Baron Samedit CVE-2021-3156 Segfault ESCU actions · alerting P Detect Baron Samedit CVE-2021-3156 via OSQuery ESCU actions · alerting P First Time Seen Child Process of Zoom ESCU actions · hunting P Linux Apparmor Bypass Via Aaexec ESCU actions · alerting P Linux Auditd Copy Fail Privilege Escalation ESCU actions · alerting P Linux Auditd Possible Setuid Execve Privesc ESCU actions · hunting P Linux Binary Launched Process with Null Argv ESCU actions · alerting P Linux Dirty Frag Kernel Privilege Escalation ESCU actions · alerting P Linux Ghostscript Exploitation ESCU actions · alerting P Linux Malformed Auth Entry ESCU actions · hunting P Linux Pedit Offset Out Of Bounds ESCU actions · alerting P Linux PF_ALG Registration Outside of Boot Window ESCU actions · alerting P Linux pkexec Privilege Escalation ESCU actions · alerting P Linux Possible GSM Privilege Escalation ESCU actions · hunting P Linux Possible Nimbuspwn Privilege Escalation ESCU actions · alerting P Linux Possible Privilege Escalation via PYTHONPATH ESCU actions · alerting P Linux Suspicious GCC Invocation Building Init Shared Object ESCU actions · alerting P Linux Suspicious Namespace Creation ESCU actions · alerting P Spoolsv Suspicious Process Access ESCU actions · alerting P Windows Admin Password Changed by Non-Admin ESCU actions · alerting P Windows Cloud Files Filter Log Created by Non-System Process ESCU actions · alerting P Windows Driver Inventory ESCU actions · hunting P Windows Driver Load Non-Standard Path ESCU actions · alerting P Windows Drivers Loaded by Signature ESCU actions · hunting P Windows MSI Rollback Script Deleted By Non-Msiexec Process ESCU actions · alerting P Windows MsMpEng Writing to System32 ESCU actions · alerting P Windows Non-System Process Querying Definition Update ESCU actions · hunting P Windows Potato Privilege Escalation Tool Execution ESCU actions · alerting P Windows Privilege Escalation Attempt Via MSI Rollback ESCU actions · alerting P Windows Privilege Escalation Suspicious Process Elevation ESCU actions · alerting P Windows Privilege Escalation System Process Without System Parent ESCU actions · alerting P Windows Privilege Escalation User Process Spawn System Process ESCU actions · alerting P Windows Remote Image Load ESCU actions · hunting P Windows Service Create Kernel Mode Driver ESCU actions · alerting P Windows Suspicious Burst of Password Changes ESCU actions · alerting P Windows Suspicious Child Process of Consent.EXE ESCU actions · hunting P Windows Suspicious Child Process of TieringEngineService.exe ESCU actions · alerting P Windows Suspicious Defender Engine or Signature Files Created ESCU actions · hunting P Windows Suspicious Defender Update Activity in INetCache ESCU actions · hunting P Windows System File on Disk ESCU actions · hunting P Windows VSSVC Process Accessing Defender Engine ESCU actions · alerting P Microsoft SharePoint Server Elevation of Privilege ESCU actions · hunting P VMWare Aria Operations Exploit Attempt ESCU actions · alerting P Splunk Low-Priv Search as nobody SplunkDeploymentServerConfig App ESCU actions · hunting P [LLM] FudModule SYSTEM injection: msiexec.exe spawned by services.exe running as SYSTEM Bespoke exploit · alerting DSΣPDDCS [LLM] Potato privilege-escalation tooling (GodPotato / SweetPotato / BadPotato) Bespoke exploit · alerting DSΣPDDCS [LLM] Gitea PR head-branch update via API v1 pulls/{index}/update (CVE-2026-58443 exploit vector) Bespoke exploit · hunting SΣP [LLM] Vulnerable Gitea instance exposed to CVE-2026-58443 (≤1.26.4) Bespoke exploit · hunting DSP [LLM] TSDProxy management-port replay: loopback connection to 127.0.0.1:8080 by non-proxy process Bespoke exploit · alerting DSΣPCS [LLM] TSDProxy management API abuse: /api/v1 request with forged x-tsdproxy-id and auth token Bespoke actions · alerting SPDD [LLM] BYOVD: Genshin Impact mhyprot.sys driver dropped/loaded outside legitimate game install (Embargo evil-mhyprot-cli) Bespoke install · alerting DSΣP [LLM] Dirty Pipe (CVE-2022-0847): /etc/passwd or /etc/shadow modified by unexpected process Bespoke exploit · alerting DSΣPCS [LLM] Dirty Pipe SUID hijack: root-privileged process executing from /tmp or /dev/shm Bespoke exploit · alerting DSΣPDDCS [LLM] Dirty Pipe (CVE-2022-0847) vulnerable kernel exposure inventory Bespoke exploit · hunting DSP [LLM] PwnKit pkexec executed with empty argv (CVE-2021-4034 exploit primitive) Bespoke exploit · alerting DSΣPDDCS [LLM] PwnKit GCONV_PATH artifact directory/file creation Bespoke exploit · alerting DSΣPCS [LLM] Unprivileged user-namespace creation (unshare CLONE_NEWUSER) preceding Linux privilege escalation Bespoke exploit · hunting DSΣPDDCS [LLM] Prototype pollution payload in CLI args (--__proto__ / constructor.prototype) to Node tool Bespoke exploit · alerting DSΣPDDCS [LLM] World-writable executable run as a shell (-c) — minimist polluted shell privesc payload Bespoke install · hunting DSΣPDDCS [LLM] Anonymous principal reaching kubelet/pod proxy subresources (CVE-2018-1002105 tunnel) Bespoke actions · alerting SΣPDDCW [LLM] FTP control-channel connection followed by write to Unix system path (CVE-2018-1315 traversal chain) Bespoke exploit · hunting DSPCS

Articles citing this technique (11)

crit Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor art-64

crit An analysis of incidents at Brazilian educational institutions art-146

crit [GHSA / CRITICAL] CVE-2026-58443: Gitea: Public-only repository tokens can update private PR head branches art-228

crit [GHSA / CRITICAL] GHSA-g936-7jqj-mwv8: TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation art-293

crit EDR killers explained: Beyond the drivers art-613

high "Dirty Pipe" Linux vulnerability and your containerized applications (CVE-2022-0847) art-2501

high Analyzing the PwnKit local privilege escalation exploit art-2677

crit Kernel privilege escalation: how Kubernetes container isolation impacts privilege escalation attacks art-3268

crit Exploring the minimist prototype pollution security vulnerability art-3417

high Critical Arbitrary Code Execution Vulnerability Found in Kubernetes art-3601

high Attacking an FTP Client: MGETting more than you bargained for art-3636