Exploitation for Privilege Escalation `T1068`

Tactic: Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Events covered

42 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 6	Driver loaded
Sysmon	Event ID 7	Image loaded
Sysmon	Event ID 10	ProcessAccess
Sysmon	Event ID 11	FileCreate
Sysmon	Event ID 12	RegistryEvent (Object create and delete)
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 14	RegistryEvent (Key and Value Rename)
Sysmon	Event ID 15	FileCreateStreamHash
Sysmon	Event ID 22	DNSEvent (DNS query)
Sysmon	Event ID 23	FileDelete (File Delete archived)
Sysmon	Event ID 26	FileDeleteDetected (File Delete logged)
Security-Auditing	Event ID 4657	A registry value was modified.
Security-Auditing	Event ID 4673	A privileged service was called.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4723	An attempt was made to change an account's password.
Security-Auditing	Event ID 4724	An attempt was made to reset an account's password.
Security-Auditing	Event ID 4741	A computer account was created.
Security-Auditing	Event ID 4742	A computer account was changed.
Security-Auditing	Event ID 4768	A Kerberos authentication ticket (TGT) was requested.
Security-Auditing	Event ID 4769	A Kerberos service ticket was requested.
Security-Auditing	Event ID 4781	The name of an account was changed.
Security-Auditing	Event ID 4887	Certificate Services approved a certificate request and issued a certificate.
Security-Auditing	Event ID 5136	A directory service object was modified.
Defender-DeviceEvents	any	Defender event
Defender-DeviceFileEvents	any	File activity
Defender-DeviceFileEvents	FileCreated	File created
Defender-DeviceNetworkEvents	NetworkSignatureInspected	Network signature inspected
Defender-DeviceProcessEvents	any	Process activity
Defender-DeviceTvmSoftwareVulnerabilities	any	Software vulnerabilities on devices
ESF	exec	Process Execution
ESF	xpc_connect	XPC Service Connection
Linux-Auditd	Event ID 1300	SYSCALL
Linux-Auditd	Event ID 1302	PATH
Linux-Auditd	Event ID 1309	EXECVE
Linux-Auditd	Event ID 1321	BPRM_FCAPS
Audit-CVE	Event ID 1	Possible detection of CVE: PossibleDetectionOfCVE.
Windows-Defender	Event ID 1116	Product Name has detected malware or other potentially unwanted software.
Windows-Defender	Event ID 1117	Product Name has taken action to protect this machine from malware or other potentially unwanted software.
Service-Control-Manager	Event ID 7045	A service was installed in the system.
Sysmon-for-Linux	Event ID 1	Process Create
Sysmon-for-Linux	Event ID 11	File created

Authoring guide

These 237 rules share fields, values, and exclusions.

Fields filtered most (218 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	78	`eq` 66, `in` 9, `ne` 7, `wildcard` 1	`exec`, `start`, `uid_change`, `deletion`, `ProcessRollup2`
`event.type`	56	`eq` 52, `ne` 3, `in` 1	`start`, `change`, `deletion`, `creation`, `process_started`
`process_name`	53	`eq` 34, `in` 14, `starts_with` 5, `is_not_null` 4, `ends_with` 2, `contains` 1, `ne` 1, `regex_match` 1, `wildcard` 1	`bash`, `sudo`, `dash`, `aa-exec`, `cmd.exe`
`host.os.type`	41	`eq` 41
`Image`	40	`ends_with` 14, `starts_with` 11, `eq` 6, `wildcard` 5, `in` 4, `is_not_null` 4, `ne` 3, `contains` 2, `is_null` 1, `regex_match` 1	`/dev/shm/`, `/home//`, `.`, `/dev/shm/`, `\\\\`
`user.id`	39	`eq` 28, `ne` 23, `is_not_null` 5, `starts_with` 2, `ge` 1, `wildcard` 1	`0`, `S-1-5-18`, `s-1-5-18`, `1000`, `S-1-12-`
`process.args`	35	`eq` 20, `in` 12, `wildcard` 8, `starts_with` 7, `contains` 2, `ends_with` 2	`-R`, `-m`, `-o`, `-f`, `--user`
`CommandLine`	32	`contains` 23, `in` 4, `regex_match` 3, `is_not_null` 2, `starts_with` 2, `ends_with` 1, `eq` 1, `wildcard` 1	`sudo --chroot`, `--chroot` , `-p` , `-u#`, `/account`
`TargetFilename`	30	`wildcard` 11, `contains` 8, `starts_with` 6, `ends_with` 5, `in` 3, `eq` 2	`.sys`, `//etc/nsswitch.conf`, `/gconv_path*`, `/etc/passwd`, `?:\config.msi\`
`EventID`	29	`eq` 26, `in` 3	`11`, `1`, `4688`, `10`, `23`
`ParentImage`	24	`wildcard` 9, `ends_with` 5, `eq` 3, `in` 3, `starts_with` 3, `is_not_null` 2, `regex_match` 1	`/home//`, `/dev/shm/`, `.`, `./`, `\\\\*`
`parent_process_name`	21	`eq` 13, `in` 6, `wildcard` 3, `regex_match` 2	`bash`, `.*`, `bun`, `(?i):\x5cWindows\x5csystem32\x5cconsent\.exe`, `brave.exe`
`user`	12	`eq` 8, `in` 2, `contains` 1, `cross_field_compare` 1	`root`, `$`, `authority`, `system*`, `0`
`process.parent.user.id`	10	`ne` 8, `ge` 2	`0`, `1000`
`file.extension`	9	`eq` 9	`dll`, `exe`, `rbs`, `blf`, `spl`

Top indicator values (6945 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.type`	`eq`	`start` elasticCVE-2023-0386 Exploitation Attempt elasticGeneral Privilege Escalation Sequence Detected elasticPersistence via Update Orchestrator Service Hijack elasticPotential Cgroup Privilege Escalation/Container Escape via Mount elasticPotential CVE-2025-32463 Sudo Chroot Execution Attempt elasticPotential CVE-2025-32463 Sudo Chroot Execution Attempt elasticPotential Escalation via Vulnerable MSI Repair elasticPotential Local Privilege Escalation via a Suspicious Descendant Process elasticPotential Local Privilege Escalation via Unshare elasticPotential PackageKit TOCTOU Privilege Escalation via CVE-2026-41651 elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via a Suspicious UID Change +31 more rules	46	1087
`event.type`	`eq`	`change` elasticGeneral Privilege Escalation Sequence Detected elasticPotential Local Privilege Escalation via Unshare elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via Enlightenment elasticPotential Privilege Escalation via OverlayFS elasticPotential Privilege Escalation via Python cap_setuid elasticPotential Privilege Escalation via Python Exploit elasticPotential Privilege Escalation via Recently Compiled Executable elasticPotential Privilege Escalation via unshare and UID Change elasticPotential Shadow Read via Unprivileged User elasticPrivilege Escalation via CAP_CHOWN/CAP_FOWNER Capabilities elasticPrivilege Escalation via CAP_SETUID/SETGID Capabilities elasticSuspicious UID Change to Root via Python +2 more rules	17	95
`EventType`	`eq`	`exec` elasticCVE-2023-0386 Exploitation Attempt elasticGeneral Privilege Escalation Sequence Detected elasticPotential Cgroup Privilege Escalation/Container Escape via Mount elasticPotential CVE-2025-32463 Sudo Chroot Execution Attempt elasticPotential Local Privilege Escalation via a Suspicious Descendant Process elasticPotential Local Privilege Escalation via Unshare elasticPotential PackageKit TOCTOU Privilege Escalation via CVE-2026-41651 elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via Busctl System Call elasticPotential Privilege Escalation via CVE-2023-4911 elasticPotential Privilege Escalation via Enlightenment +23 more rules	38	579
`EventType`	`eq`	`start` elasticDriver Dropped by Untrusted Executable elasticElevation via Common Log File System Exploitation elasticKernel Driver Registered via NtLoadDriver elasticPotential Exploitation via ComDotNet Exploit elasticPotential Privilege Escalation via MSI Repair elasticPotential Privilege Escalation via RoguePlanet Windows Defender Exploit elasticPrivilege Escalation via NTLMRelay2Self elasticPrivilege Escalation via Windows Installer Hijack elasticSuspicious Execution as System via Windows Command Shell elasticUnusual Child Process Integrity Level elasticUnusual Desktop Window Manager Child Process elasticUnusual Privilege Escalation to System	12	392
`EventType`	`eq`	`uid_change` elasticGeneral Privilege Escalation Sequence Detected elasticPotential Local Privilege Escalation via Unshare elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via Enlightenment elasticPotential Privilege Escalation via OverlayFS elasticPotential Privilege Escalation via Python Exploit elasticPotential Privilege Escalation via unshare and UID Change elasticPrivilege Escalation via CAP_SETUID/SETGID Capabilities elasticSuspicious UID Change to Root via Python elasticUID Change to 0 from Unusual Process Executable	12	19
`user.id`	`eq`	`0` elasticGeneral Privilege Escalation Sequence Detected elasticPotential Local Privilege Escalation via a Suspicious Descendant Process elasticPotential Local Privilege Escalation via Unshare elasticPotential PackageKit TOCTOU Privilege Escalation via CVE-2026-41651 elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via Enlightenment elasticPotential Privilege Escalation via Fuse Binary elasticPotential Privilege Escalation via OverlayFS elasticPotential Privilege Escalation via Python cap_setuid elasticPotential Privilege Escalation via Python Exploit elasticPotential Privilege Escalation via Recently Compiled Executable elasticPotential Privilege Escalation via unshare and UID Change elasticPotential Privilege Escalation via unshare Followed by Root Process +5 more rules	20	28
`user.id`	`ne`	`0` elasticGeneral Privilege Escalation Sequence Detected elasticPotential Copy Fail (CVE-2026-31431) Exploitation via AF_ALG Socket elasticPotential Local Privilege Escalation via Unshare elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via Busctl System Call elasticPotential Privilege Escalation via OverlayFS elasticPotential Privilege Escalation via Python cap_setuid elasticPotential Privilege Escalation via Recently Compiled Executable elasticPotential Privilege Escalation via unshare and UID Change elasticPotential Privilege Escalation via unshare Followed by Root Process elasticPotential snap-confine Privilege Escalation via CVE-2026-3888 elasticPrivilege Escalation via CAP_CHOWN/CAP_FOWNER Capabilities elasticPrivilege Escalation via CAP_SETUID/SETGID Capabilities +4 more rules	19	28
`IntegrityLevel`	`eq`	`System` sigmaExploiting CVE-2019-1388 sigmaPotential CVE-2021-41379 Exploitation Attempt sigmaSuspicious Spool Service Child Process elasticUnusual Print Spooler Child Process splunkWindows Privilege Escalation Suspicious Process Elevation splunkWindows Privilege Escalation System Process Without System Parent splunkWindows Privilege Escalation User Process Spawn System Process splunkWindows Wermgr Spawning System Integrity Process	8	31
`ParentImage`	`wildcard`	`/home//` elasticPotential Local Privilege Escalation via a Suspicious Descendant Process elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Shadow Read via Unprivileged User elasticSuspicious SUID/SGID Utility Execution	8	18
`ParentImage`	`wildcard`	`/dev/shm/*` elasticPotential Local Privilege Escalation via a Suspicious Descendant Process elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Shadow Read via Unprivileged User elasticSuspicious SUID/SGID Utility Execution	6	17
`ParentImage`	`wildcard`	`/run/user/*` elasticPotential Local Privilege Escalation via a Suspicious Descendant Process elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Shadow Read via Unprivileged User elasticSuspicious SUID/SGID Utility Execution	6	16
`ParentImage`	`wildcard`	`/tmp/*` elasticPotential Local Privilege Escalation via a Suspicious Descendant Process elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Shadow Read via Unprivileged User elasticSuspicious SUID/SGID Utility Execution	6	19
`ParentImage`	`wildcard`	`/var/run/user/*` elasticPotential Local Privilege Escalation via a Suspicious Descendant Process elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Shadow Read via Unprivileged User elasticSuspicious SUID/SGID Utility Execution	6	16
`ParentImage`	`wildcard`	`/var/tmp/*` elasticPotential Local Privilege Escalation via a Suspicious Descendant Process elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Shadow Read via Unprivileged User elasticSuspicious SUID/SGID Utility Execution	6	19
`process.parent.user.id`	`ne`	`0` elasticPotential Local Privilege Escalation via Unshare elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via Busctl System Call elasticPotential Privilege Escalation via Python Exploit	8	13
`EventType`	`ne`	`deletion` elasticDriver Dropped by Untrusted Executable elasticElevation via Common Log File System Exploitation elasticMSI Rollback Script File by Unusual Process elasticPotential Common Log File System Exploit elasticPotential Common Log File System Vulnerability Exploitation elasticPrivilege Escalation via PKEXEC Exploitation elasticPrivilege Escalation via Windows Installer Hijack	7	87
`process.Ext.token.integrity_level_name`	`eq`	`system` elasticPotential Privilege Escalation via InstallerFileTakeOver elasticPotential Privilege Escalation via MSI Repair elasticPrivilege Escalation via Windows Installer Hijack elasticSuspicious Execution as System via Windows Command Shell elasticUnusual Child Process Integrity Level elasticUnusual Print Spooler Child Process elasticUnusual Privilege Escalation to System	7	14
`process.group.id`	`eq`	`0` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPrivilege Escalation via SUID/SGID elasticSuspicious SUID/SGID Utility Execution	7	10
`process.real_group.id`	`ne`	`0` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPrivilege Escalation via SUID/SGID elasticSuspicious SUID/SGID Utility Execution	7	9
`process.real_user.id`	`ne`	`0` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPrivilege Escalation via SUID/SGID elasticSuspicious SUID/SGID Utility Execution	7	9
`process.user.id`	`eq`	`0` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPotential Privilege Escalation via SUID/SGID Proxy Execution elasticPrivilege Escalation via SUID/SGID elasticSuspicious SUID/SGID Utility Execution	7	10
`EventType`	`in`	`exec` elasticPotential CVE-2025-32463 Sudo Chroot Execution Attempt elasticPotential Shadow File Read via Command Line Utilities elasticPotential Shell via Wildcard Injection Detected elasticPotential Sudo Privilege Escalation via CVE-2019-14287 elasticPotential Telnet Authentication Bypass (CVE-2026-24061) elasticPotential Unauthorized Access via Wildcard Injection Detected	6	206
`Image`	`starts_with`	`/dev/shm/` elasticGeneral Privilege Escalation Sequence Detected elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPrivilege Escalation via PKEXEC Exploitation elasticShell Privileged Mode from Non-Standard Path with Root Effective User elasticUID Change to 0 from Unusual Process Executable	6	53
`Image`	`starts_with`	`/tmp/` elasticGeneral Privilege Escalation Sequence Detected elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPrivilege Escalation via PKEXEC Exploitation elasticShell Privileged Mode from Non-Standard Path with Root Effective User elasticUID Change to 0 from Unusual Process Executable	6	58
`Image`	`starts_with`	`/var/tmp/` elasticGeneral Privilege Escalation Sequence Detected elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPrivilege Escalation via PKEXEC Exploitation elasticShell Privileged Mode from Non-Standard Path with Root Effective User elasticUID Change to 0 from Unusual Process Executable	6	56
`event.category`	`eq`	`process` elasticPotential Copy Fail (CVE-2026-31431) Exploitation via AF_ALG Socket elasticPotential Privilege Escalation via Linux DAC permissions elasticPotential Privilege Escalation via RoguePlanet Windows Defender Exploit elasticPotential Shadow File Read via Command Line Utilities elasticSuspicious UID Change to Root via Python elasticUnsigned DLL loaded by DNS Service	6	141
`process.code_signature.exists`	`eq`	`false` elasticBLF File Creation by an Unusual Process elasticDriver Dropped by Untrusted Executable elasticKernel Driver Registered via NtLoadDriver elasticSuspicious DNS Lookup for Microsoft Defender Definition Updates elasticSuspicious NtOSKrnl Image Load elasticSuspicious PrivilegedHelperTool Activity	6	119
`process.code_signature.trusted`	`eq`	`false` elasticBLF File Creation by an Unusual Process elasticDriver Dropped by Untrusted Executable elasticKernel Driver Registered via NtLoadDriver elasticSuspicious DNS Lookup for Microsoft Defender Definition Updates elasticSuspicious NtOSKrnl Image Load elasticSuspicious PrivilegedHelperTool Activity	6	115
`process.parent.group.id`	`ne`	`0` elasticPotential Privilege Escalation via a Known SUID/SGID Binary elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a SUID/SGID Binary elasticPotential Privilege Escalation via a Suspicious UID Change elasticPotential Privilege Escalation via Python Exploit	6	11
`process_name`	`in`	`bash` elasticPotential Copy Fail (CVE-2026-31431) Exploitation via AF_ALG Socket elasticPotential CVE-2025-32463 Nsswitch File Creation elasticPotential CVE-2025-32463 Nsswitch File Creation elasticPotential Privilege Escalation via SUID Binary elasticPotential Privilege Escalation via unshare Followed by Root Process elasticPrivilege Escalation via SUID/SGID	6	202

Exclusions (983 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`user.id`	`eq`	`s-1-5-18` elasticElevation via Common Log File System Exploitation elasticPotential Common Log File System Vulnerability Exploitation elasticPotential privilege escalation via CVE-2022-38028 elasticPotential Privilege Escalation via LocalPotato Exploit elasticPrivilege Escalation via Windows Installer Hijack elasticSuspicious Kernel Mode Address Manipulation elasticSuspicious Print Spooler SPL File Created	7
`process.code_signature.trusted`	`eq`	`true` elasticPotential Privilege Escalation via InstallerFileTakeOver elasticProcess Explorer Device Access by Unusual Process elasticSuspicious System Path File Overwrite elasticUnusual Child Process Integrity Level elasticUnusual Privilege Escalation to System	5
`Image`	`eq`	`?:\windows\system32\werfault.exe` elasticUnusual Child Process Integrity Level elasticUnusual Desktop Window Manager Child Process elasticUnusual Privilege Escalation to System	3
`Image`	`starts_with`	`/tmp/newroot/` elasticPotential Local Privilege Escalation via a Suspicious Descendant Process elasticPotential Shadow File Read via Command Line Utilities elasticPotential Shell via Wildcard Injection Detected	3
`Image`	`wildcard`	`/run/user//.bubblewrap/` elasticPotential Local Privilege Escalation via a Suspicious Descendant Process elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change	3
`Image`	`wildcard`	`/tmp/newroot/*` elasticPotential Privilege Escalation via a Parent Process Sequence elasticPrivilege Escalation via CAP_SETUID/SETGID Capabilities elasticUID Change to 0 from Unusual Process Executable	3
`Image`	`wildcard`	`/tmp/newroot/usr/bin/sudo` elasticPotential Local Privilege Escalation via a Suspicious Descendant Process elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change	3
`ParentImage`	`starts_with`	`/tmp/newroot/` elasticPotential Local Privilege Escalation via a Suspicious Descendant Process elasticPotential Privilege Escalation via Linux DAC permissions elasticPrivilege Escalation via CAP_SETUID/SETGID Capabilities	3
`ParentImage`	`wildcard`	`/home/*/.bun/bin/bun` elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change	3
`ParentImage`	`wildcard`	`/home//.conda/envs/fmf_server_agent/bin/python` elasticPotential Local Privilege Escalation via a Suspicious Descendant Process elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence	3
`ParentImage`	`wildcard`	`/home/*/.local/bin/agy` elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change	3
`ParentImage`	`wildcard`	`/home/*/.local/bin/copilot` elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change	3
`ParentImage`	`wildcard`	`/home//.local/share/containers/storage/overlay/` elasticPotential Local Privilege Escalation via a Suspicious Descendant Process elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via Linux DAC permissions	3
`ParentImage`	`wildcard`	`/home//.local/share/mise/installs/node//bin/node` elasticPotential Local Privilege Escalation via a Suspicious Descendant Process elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence	3
`ParentImage`	`wildcard`	`/tmp/go-build//sso.test` elasticPotential Privilege Escalation via a Parent Process Sequence elasticPotential Privilege Escalation via a Parent/Child Process Sequence elasticPotential Privilege Escalation via a Suspicious UID Change	3

Exploitation for Privilege Escalation `T1068`

Events covered

Authoring guide

Fields filtered most (218 distinct)

Top indicator values (6945 distinct)

Exclusions (983 distinct)

Rules under this technique

Sigma 37 rules

Elastic 116 rules

Splunk 61 rules

Kusto 20 rules

YARA-L 1 rule

Panther 2 rules

Exploitation for Privilege Escalation T1068

Events covered

Authoring guide

Fields filtered most (218 distinct)

Top indicator values (6945 distinct)

Exclusions (983 distinct)

Rules under this technique

Sigma 37 rules

Elastic 116 rules

Splunk 61 rules

Kusto 20 rules

YARA-L 1 rule

Panther 2 rules

Exploitation for Privilege Escalation `T1068`