Exploitation for Privilege Escalation
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions. (Citation: The MITRE Corporation) When initially gaining access to a system, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system. Vulnerabilities may exist, usually in operating system components and software commonly running at higher permissions, that can be exploited to gain higher levels of access on the system. This could enable someone to move from unprivileged or user level permissions to SYSTEM or root permissions depending on the component that is vulnerable. This may be a necessary step for an adversary compromising an endpoint system that has been properly configured and limits other privilege escalation methods. (Citation: The MITRE Corporation)
Mapped SPARTA techniques
3 techniques
T0890 'Exploitation for Privilege Escalation' addresses adversary exploitation of software vulnerabilities in programs/services/OS to take advantage of programming errors; SPARTA EX-0009.01 'Flight Software' covers exploitation of FSW code flaws — the activity (exploit code vulnerabilities) is the same. Cross-tactic moderate because T0890 sits in privilege-escalation while SPARTA EX-0009.01 is execution; ICS has no execution-tactic generic exploit-for-execution technique unlike MITRE Enterprise's T1203.
Exploitation of OS-layer code flaws (RTOS kernel, drivers, board-support package) is the same activity as T0890 'Exploitation for Privilege Escalation' applied to the OS layer. Cross-tactic moderate (priv-esc vs execution); ICS has no execution-tactic exploit-for-execution technique.
Exploiting known CVEs in COTS/FOSS components is the same activity as T0890 'Exploitation for Privilege Escalation' — leveraging documented vulnerabilities. Cross-tactic moderate (priv-esc vs execution).
Cite as SafeMode Space, mitre-attack-ics T0890.