1200KM / tag
privilege-escalation — tactic tag
103 related reference pages for tactic: privilege-escalation.
Meaning and evidence boundary
Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.
Related pages
- T0874 Hooking · simulation
- T0890 Exploitation for Privilege Escalation · simulation
- T1037 Boot or Logon Initialization Scripts · simulation
- T1037.001 Logon Script (Windows) · simulation
- T1037.002 Login Hook · simulation
- T1037.003 Network Logon Script · simulation
- T1037.004 RC Scripts · simulation
- T1037.005 Startup Items · simulation
- T1053 Scheduled Task/Job · simulation
- T1053.002 At · simulation
- T1053.003 Cron · simulation
- T1053.005 Scheduled Task · simulation
- T1053.006 Systemd Timers · simulation
- T1053.007 Container Orchestration Job · simulation
- T1055 Process Injection · simulation
- T1055.001 Dynamic-link Library Injection · simulation
- T1055.002 Portable Executable Injection · simulation
- T1055.003 Thread Execution Hijacking · simulation
- T1055.004 Asynchronous Procedure Call · simulation
- T1055.005 Thread Local Storage · simulation
- T1055.008 Ptrace System Calls · simulation
- T1055.009 Proc Memory · simulation
- T1055.011 Extra Window Memory Injection · simulation
- T1055.012 Process Hollowing · simulation
- T1055.013 Process Doppelgänging · simulation
- T1055.014 VDSO Hijacking · simulation
- T1055.015 ListPlanting · simulation
- T1068 Exploitation for Privilege Escalation · simulation
- T1078 Valid Accounts · simulation
- T1078.001 Default Accounts · simulation
- T1078.002 Domain Accounts · simulation
- T1078.003 Local Accounts · simulation
- T1078.004 Cloud Accounts · simulation
- T1098 Account Manipulation · simulation
- T1098.001 Additional Cloud Credentials · simulation
- T1098.002 Additional Email Delegate Permissions · simulation
- T1098.003 Additional Cloud Roles · simulation
- T1098.004 SSH Authorized Keys · simulation
- T1098.005 Device Registration · simulation
- T1098.006 Additional Container Cluster Roles · simulation
- T1098.007 Additional Local or Domain Groups · simulation
- T1134 Access Token Manipulation · simulation
- T1134.001 Token Impersonation/Theft · simulation
- T1134.002 Create Process with Token · simulation
- T1134.003 Make and Impersonate Token · simulation
- T1134.004 Parent PID Spoofing · simulation
- T1134.005 SID-History Injection · simulation
- T1404 Exploitation for Privilege Escalation · simulation
- T1484 Domain or Tenant Policy Modification · simulation
- T1484.001 Group Policy Modification · simulation
- T1484.002 Trust Modification · simulation
- T1543 Create or Modify System Process · simulation
- T1543.001 Launch Agent · simulation
- T1543.002 Systemd Service · simulation
- T1543.003 Windows Service · simulation
- T1543.004 Launch Daemon · simulation
- T1543.005 Container Service · simulation
- T1546 Event Triggered Execution · simulation
- T1546.001 Change Default File Association · simulation
- T1546.002 Screensaver · simulation
- T1546.003 Windows Management Instrumentation Event Subscription · simulation
- T1546.004 Unix Shell Configuration Modification · simulation
- T1546.005 Trap · simulation
- T1546.006 LC_LOAD_DYLIB Addition · simulation
- T1546.007 Netsh Helper DLL · simulation
- T1546.008 Accessibility Features · simulation
- T1546.009 AppCert DLLs · simulation
- T1546.010 AppInit DLLs · simulation
- T1546.011 Application Shimming · simulation
- T1546.012 Image File Execution Options Injection · simulation
- T1546.013 PowerShell Profile · simulation
- T1546.014 Emond · simulation
- T1546.015 Component Object Model Hijacking · simulation
- T1546.016 Installer Packages · simulation
- T1546.017 Udev Rules · simulation
- T1546.018 Python Startup Hooks · simulation
- T1547 Boot or Logon Autostart Execution · simulation
- T1547.001 Registry Run Keys / Startup Folder · simulation
- T1547.002 Authentication Package · simulation
- T1547.003 Time Providers · simulation
- T1547.004 Winlogon Helper DLL · simulation
- T1547.005 Security Support Provider · simulation
- T1547.006 Kernel Modules and Extensions · simulation
- T1547.007 Re-opened Applications · simulation
- T1547.008 LSASS Driver · simulation
- T1547.009 Shortcut Modification · simulation
- T1547.010 Port Monitors · simulation
- T1547.012 Print Processors · simulation
- T1547.013 XDG Autostart Entries · simulation
- T1547.014 Active Setup · simulation
- T1547.015 Login Items · simulation
- T1548 Abuse Elevation Control Mechanism · simulation
- T1548.001 Setuid and Setgid · simulation
- T1548.002 Bypass User Account Control · simulation
- T1548.003 Sudo and Sudo Caching · simulation
- T1548.004 Elevated Execution with Prompt · simulation
- T1548.005 Temporary Elevated Cloud Access · simulation
- T1548.006 TCC Manipulation · simulation
- T1611 Escape to Host · simulation
- T1626 Abuse Elevation Control Mechanism · simulation
- T1626.001 Device Administrator Permissions · simulation
- T1631 Process Injection · simulation
- T1631.001 Ptrace System Calls · simulation
Connected ecosystem references
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.