1200KM / simulation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will…
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
When initially gaining access to a system, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system. Vulnerabilities may exist, usually in operating system components and software commonly running at higher permissions, that can be exploited to gain higher levels of access on the system. This could enable someone to move from unprivileged or user level permissions to SYSTEM or root permissions depending on the component that is vulnerable. This could also enable an adversary to move from a virtualized environment, such as within a virtual machine or container, onto the underlying host. This may be a necessary step for an adversary compromising an endpoint system that has been properly configured and limits other privilege escalation methods.
Adversaries may bring a signed vulnerable driver onto a compromised machine so that they can exploit the vulnerability to execute code in kernel mode. This process is sometimes referred to as Bring Your Own Vulnerable Driver (BYOVD).[ESET InvisiMole June 2020][Unit42 AcidBox June 2020] Adversaries may include the vulnerable driver with files delivered during Initial Access or download it to a compromised system via Ingress Tool Transfer or Lateral Tool Transfer.
Official technique definition · Open in the interactive matrix
These contracts are selected through exact technique-to-data-component relationships or explicitly labelled planning overrides. Configure a collector at the relevant observation point; a telemetry name alone is not coverage.
DC0091 collection page — Use authorized Docker API access auditing/instrumentation for list requests; a read-only inventory snapshot gives state but does not prove someone else enumerated containers.
Required normalized fields: actor, api_operation, scope, result.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0091",
"collector": "illustrative-lab-collector",
"observation": {
"actor": "lab-reader",
"api_operation": "container_list",
"scope": "lab-daemon",
"result": "success"
}
}Visibility limits: Runtime event history is bounded and can be lost without continuous collection. Image tags are mutable; pin digests. A lifecycle event is not a full process or file audit.
DC0079 collection page — Collect Sysmon DriverLoad (6) and retain image path, hash and signature result; distinguish load from file installation.
Required normalized fields: driver_path, action, signature_status.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0079",
"collector": "illustrative-lab-collector",
"observation": {
"driver_path": "C:\\Lab\\demo.sys",
"action": "load",
"signature_status": "lab_fixture_only"
}
}Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
DC0067 collection page — Enable Audit Logon and collect successful session creation on the receiving host; join session/logon IDs rather than only account names.
Required normalized fields: account, logon_id, logon_type, source_ip.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0067",
"collector": "illustrative-lab-collector",
"observation": {
"account": "LAB\\analyst",
"logon_id": "0x12345",
"logon_type": 3,
"source_ip": "192.0.2.10"
}
}Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.
DC0088 collection page — Collect supported session inventory and correlate session IDs with authentication, logon and logoff events.
Required normalized fields: session_id, account, host, session_type.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0088",
"collector": "illustrative-lab-collector",
"observation": {
"session_id": "lab-session-1",
"account": "LAB\\analyst",
"host": "lab-host-1",
"session_type": "interactive"
}
}Visibility limits: Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.
DC0016 collection page — Scope Sysmon ImageLoad (7) to lab processes/paths; retain module hash, signer and destination process. Inventory alone does not prove a module loaded.
Required normalized fields: process_id, image_loaded, signed, action.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0016",
"collector": "illustrative-lab-collector",
"observation": {
"process_id": 4200,
"image_loaded": "C:\\Lab\\demo.dll",
"signed": false,
"action": "load"
}
}Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
DC0035 collection page — Scope Sysmon ProcessAccess (10) to the selected source/target processes and access rights; retain call-trace fields where emitted.
Required normalized fields: source_process_id, target_process_id, granted_access, action.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0035",
"collector": "illustrative-lab-collector",
"observation": {
"source_process_id": 4200,
"target_process_id": 4300,
"granted_access": "0x1000",
"action": "open_process"
}
}Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.
Required normalized fields: process_guid, image, parent_image, command_line, user.
<EventFiltering>
<ProcessCreate onmatch="include">
<Image condition="is">C:\Windows\System32\whoami.exe</Image>
</ProcessCreate>
</EventFiltering>This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0032",
"collector": "illustrative-lab-collector",
"observation": {
"process_guid": "lab-process-001",
"image": "C:\\Windows\\System32\\whoami.exe",
"parent_image": "C:\\Windows\\System32\\cmd.exe",
"command_line": "whoami",
"user": "LAB\\analyst"
}
}Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
Open the dedicated detection workspace · Existing query engineering
Detects exploitation attempts targeting vulnerable kernel drivers or OS components, often followed by unusual process or token behavior.
Platforms: Windows.
Detects escalation via vulnerable setuid binaries or kernel modules, often chained with unusual access to /proc/kallsyms or /dev/kmem.
Platforms: Linux.
Detects use of vulnerable kernel extensions or entitlements abused via setuid or AppleScript injection chains.
Platforms: macOS.
Detects container breakout behavior via exploitation (e.g., DirtyPipe, CVE-2022-0847), followed by host OS interaction or escalated capability assignment.
Platforms: Containers.
15 exact-tagged source rules. A source tag is a discovery aid, not a relevance verdict. Check the observation point and actual condition of each rule.
MATCH(exploit_mitigation_alert OR known_local_exploit_signature) -> ALERT; SEQUENCE(unprivileged_process, privileged_child_process) WITHIN 1m -> ALERTNo exact technique-specific Atlas model is present for T1068 in the selected source snapshot. The following is a design worksheet, not a newly validated model.
Start from the exact analytic above. The collection-specific lenses below are analyst recommendations; they do not assert that an arbitrary statistical deviation detects this technique.
Anomaly Detection Atlas · Baseline, validation and blind spots
These are exact ATT&CK software-use relationships, including malware. They provide behavior context, not recommendations to download or execute malware. No safety or detector claim is inherited.
JHUHUGIT has exploited CVE-2015-1701 and CVE-2015-2387 to escalate privileges.[ESET Sednit Part 1][ESET Sednit July 2015]
Exact relationship: relationship--976202db-cdfa-4c4e-bc09-9b3cad90e6fbCosmicDuke attempts to exploit privilege escalation vulnerabilities CVE-2010-0232 or CVE-2010-4398.[F-Secure The Dukes]
Exact relationship: relationship--63f0007e-833e-4d6a-b79e-873525979f40Remsec has a plugin to drop and execute vulnerable Outpost Sandbox or avast! Virtualization drivers in order to gain kernel mode privileges.[Kaspersky ProjectSauron Technical Analysis]
Exact relationship: relationship--131fde9c-7a83-4603-9c1e-c41f815fb14cCobalt Strike can exploit vulnerabilities such as MS14-058.[Cobalt Strike TTPs Dec 2017][Cobalt Strike Manual 4.3 November 2020]
Exact relationship: relationship--412a57f3-ce06-4790-8e3a-cb8c34b9e0f1Wingbird exploits CVE-2016-4117 to allow an executable to gain escalated privileges.[Microsoft SIR Vol 21]
Exact relationship: relationship--dbccbeab-26c9-476e-b529-c193f9796cbcInvisiMole has exploited CVE-2007-5633 vulnerability in the speedfan.sys driver to obtain kernel mode privileges.[ESET InvisiMole June 2020]
Exact relationship: relationship--64fe312b-e489-4698-9924-aeb22c056e2bEmpire can exploit vulnerabilities such as MS16-032 and MS16-135.[Github PowerShell Empire]
Exact relationship: relationship--4507ba2b-e23c-4acf-a6a3-5ed9dae8d590PoshC2 contains modules for local privilege escalation exploits such as CVE-2016-9192 and CVE-2016-0099.[GitHub PoshC2]
Exact relationship: relationship--248b1bfc-5f9a-4f2c-ad6c-556045d9e83bCarberp has exploited multiple Windows vulnerabilities (CVE-2010-2743, CVE-2010-3338, CVE-2010-4398, CVE-2008-1084) and a .NET Runtime Optimization vulnerability for privilege escalation.[ESET Carberp March 2012][Prevx Carberp March 2011]
Exact relationship: relationship--5fdf6cb3-8046-4c32-aca6-75cda70b7614Hildegard has used the BOtB tool which exploits CVE-2019-5736.[Unit 42 Hildegard Malware]
Exact relationship: relationship--f7e5f676-46e1-4241-b0bb-fb32d891896aStuxnet used MS10-073 and an undisclosed Task Scheduler vulnerability to escalate privileges on local Windows machines.[Nicolas Falliere, Liam O Murchu, Eric Chien February 2011]
Exact relationship: relationship--9b7b3fc7-0151-4848-9b66-774eaf72561fSiloscape has leveraged a vulnerability in Windows containers to perform an Escape to Host.[Unit 42 Siloscape Jun 2021]
Exact relationship: relationship--ae5fcb43-0f85-4c96-9b4b-65fe6a19e4fbProLock can use CVE-2019-0859 to escalate privileges on a compromised host.[Group IB Ransomware September 2020]
Exact relationship: relationship--d910654b-9ebe-439e-b6f9-a8234bad7961XCSSET has used a zero-day exploit in the ssh launchdaemon to elevate privileges and bypass SIP.[trendmicro xcsset xcode project 2020]
Exact relationship: relationship--b26307f7-2d5a-4139-8333-e2c7a583f939Pandora can use CVE-2017-15303 to bypass Windows Driver Signature Enforcement (DSE) protection and load its driver.[Trend Micro Iron Tiger April 2021]
Exact relationship: relationship--5c60473c-6195-4aa1-ae10-394bb5f24cf1Zox has the ability to leverage local and remote exploits to escalate privileges.[Novetta-Axiom]
Exact relationship: relationship--b9ed53b8-71a5-44a3-90d1-2fb600991674ZeroCleare has used a vulnerable signed VBoxDrv driver to bypass Microsoft Driver Signature Enforcement (DSE) protections and subsequently load the unsigned RawDisk driver.[IBM ZeroCleare Wiper December 2019]
Exact relationship: relationship--2d61c23b-df1a-4d90-affa-b37a55b5e941BlackByte 2.0 Ransomware exploits a vulnerability in the RTCore64.sys driver (CVE-2019-16098) to enable privilege escalation and defense evasion when run as a service.[Microsoft BlackByte 2023]
Exact relationship: relationship--647eae34-69ab-4cc9-aa9e-44ff570d4fd2Embargo has leveraged MS4Killer to deliver a vulnerable driver to the victim device, sometimes referred to as Bring Your Own Vulnerable Driver (BYOVD).[ESET Embargo Ransomware October 2024] Embargo has utilized the vulnerable driver probmon.sys version 3.0.0.4 which had a revoked certificated from “ITM System Co.,LTD.”[ESET Embargo Ransomware October 2024]
Exact relationship: relationship--0cdabb4e-45d7-4307-818e-0647c08a8b45Atomic evidence: 2 compatible documented candidates. Live lab status: not run for these imported procedures.
Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.
Observed TTP of threat actor Scattered Spider, where a an older, legitimate, cryptographically signed Intel driver with a known vulnerability is downloaded and run to escalate privileges
Pinned Atomic procedure · 1c9ef3e6-bde6-402c-83bc-d89ea8bfd372 · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
driver_path: Path to vulnerable Intel driver (type path; source default PathToAtomicsFolder\..\ExternalPayloads\iqvw64e.sys)Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
Observed TTP of threat actor Turla in their malware Snake, where a an older, legitimate, cryptographically signed
VirtualBox driver with a known vulnerability is downloaded and run to escalate privileges
Reference: https://unit42.paloaltonetworks.com/turla-pensive-ursa-threat-assessment/
Pinned Atomic procedure · 97f621a5-851c-484f-b784-4a9c475006ec · windows · powershell.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
driver_path: Path to vulnerable driver (type path; source default PathToAtomicsFolder\..\ExternalPayloads\vboxdrv.sys)Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
Download synthetic collection fixture (JSON) · Download the complete engineering workbook
This fixture exercises the listed collection fields. It does not reproduce Exploitation for Privilege Escalation, label its example events as malicious, or measure detection effectiveness. Use the exact analytic and selected procedure to build an independently labelled behavior-positive dataset.
Not run in this browser. No network scan or attack command is executed by this control.
All-page audit and evidence inventory · This page’s machine-readable workbook
Pinned MITRE STIX source · SHA-256 81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352. Definition and procedure context are reproduced from this snapshot, not independently re-investigated incidents.
Develop a robust cyber threat intelligence capability to determine what types and levels of threat may use software exploits and 0-days against a particular organization.
Consider blocking the execution of known vulnerable drivers that adversaries may exploit to execute code in kernel mode. Validate driver block rules in audit mode to ensure stability prior to production deployment.[Microsoft Driver Block Rules]
Make it difficult for adversaries to advance their operation through exploitation of undiscovered or unpatched vulnerabilities by using sandboxing. Other types of virtualization and application microsegmentation may also mitigate the impact of some types of exploitation. Risks of additional exploits and weaknesses in these systems may still exist. [Ars Technica Pwn2Own 2017 VM Escape]
Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. [TechNet Moving Beyond EMET] Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. [Wikipedia Control Flow Integrity] Many of these protections depend on the architecture and target application binary for compatibility and may not work for software components targeted for privilege escalation.
Update software regularly by employing patch management for internal enterprise endpoints and servers.
Source procedure platform / method / executor tags:
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.