← LeaderboardThe Skill Leaderboard

detecting-privilege-escalation-attempts

Detect privilege escalation attempts across Windows and Linux, including access token manipulation, UAC bypass, unquoted service path abuse, kernel exploits, and sudo/doas abuse. Use when threat hunting for T1068-style privilege escalation, triaging EDR/SIEM alerts on suspicious privilege changes, scoping compromise during incident response, or validating detection coverage in a purple team exercise.

Published by mukul975 ↗mukul975/Anthropic-Cybersecurity-Skills

Try your first task

detecting-privilege-escalation-attempts

Start a fresh conversation. Replace the highlighted placeholders.

Use detecting-privilege-escalation-attempts to perform an authorized hypothesis-driven hunt for Windows and Linux privilege-escalation attempts, analyze relevant telemetry for token manipulation, UAC bypass, service-path abuse, kernel-exploit, and sudo/doas indicators, then produce the documented Hunt ID report for [EDR/SIEM platform, authorized host scope, time window, and relevant alerts or IOCs].

Required inputs

  • [EDR/SIEM platform, authorized host scope, time window, and relevant alerts or IOCs]

User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗

SKILL.md

name: detecting-privilege-escalation-attemptsdescription: Detect privilege escalation attempts across Windows and Linux, including access token manipulation, UAC bypass, unquoted service path abuse, kernel exploits, and sudo/doas abuse. Use when threat hunting for T1068-style privilege escalation, triaging EDR/SIEM alerts on suspicious privilege changes, scoping compromise during incident response, or validating detection coverage in a purple team exercise.domain: cybersecuritysubdomain: threat-huntingtags: - threat-hunting- mitre-attack- privilege-escalation- token-manipulation- uac-bypass- proactive-detectionversion: '1.0'author: mahipallicense: Apache-2.0d3fend_techniques: - Token Binding- Executable Denylisting- Execution Isolation- Restore Access- Reissue Credentialnist_csf: - DE.CM-01- DE.AE-02- DE.AE-07- ID.RA-05mitre_attack: - T1046- T1057- T1082- T1083- T1068

Detecting Privilege Escalation Attempts

When to Use

  • When proactively hunting for indicators of detecting privilege escalation attempts in the environment
  • After threat intelligence indicates active campaigns using these techniques
  • During incident response to scope compromise related to these techniques
  • When EDR or SIEM alerts trigger on related indicators
  • During periodic security assessments and purple team exercises

Prerequisites

  • EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)
  • SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)
  • Sysmon deployed with comprehensive configuration
  • Windows Security Event Log forwarding enabled
  • Threat intelligence feeds for IOC correlation

Workflow

  1. Formulate Hypothesis: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.
  2. Identify Data Sources: Determine which logs and telemetry are needed to validate or refute the hypothesis.
  3. Execute Queries: Run detection queries against SIEM and EDR platforms to collect relevant events.
  4. Analyze Results: Examine query results for anomalies, correlating across multiple data sources.
  5. Validate Findings: Distinguish true positives from false positives through contextual analysis.
  6. Correlate Activity: Link findings to broader attack chains and threat actor TTPs.
  7. Document and Report: Record findings, update detection rules, and recommend response actions.

Key Concepts

ConceptDescription
T1134Access Token Manipulation
T1548.002UAC Bypass
T1068Exploitation for Privilege Escalation
T1574.009Unquoted Service Path

Tools & Systems

ToolPurpose
CrowdStrike FalconEDR telemetry and threat detection
Microsoft Defender for EndpointAdvanced hunting with KQL
Splunk EnterpriseSIEM log analysis with SPL queries
Elastic SecurityDetection rules and investigation timeline
SysmonDetailed Windows event monitoring
VelociraptorEndpoint artifact collection and hunting
Sigma RulesCross-platform detection rule format

Common Scenarios

  1. Scenario 1: Potato exploit for SYSTEM token impersonation
  2. Scenario 2: Fodhelper.exe UAC bypass technique
  3. Scenario 3: PrintSpoofer privilege escalation from service to SYSTEM
  4. Scenario 4: CVE kernel exploit for local privilege escalation

Output Format

Hunt ID: TH-DETECT-[DATE]-[SEQ]
Technique: T1134
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]