| Nature | Type | ID | Name |
|---|---|---|---|
| ChildOf | M | 233 | Privilege Escalation |
| CanFollow | S | 100 | Overflow Buffers |
| CanFollow | M | 175 | Code Inclusion |
| CanFollow | M | 242 | Code Injection |
Find process with elevated priveleges
The adversary probes for processes running with elevated privileges.
| Technique |
|---|
| On Windows, use the process explorer's security tab to see if a process is running with administror privileges. |
| On Linux, use the ps command to view running processes and pipe the output to a search for a particular user, or the root user. |
Find vulnerability in running process
The adversary looks for a vulnerability in the running process that would allow for arbitrary code execution with the privilege of the running process.
| Technique |
|---|
| Look for improper input validation |
| Look for a buffer overflow which may be exploited if an adversary can inject unvalidated data. |
| Utilize system utilities that support process control that have been inadequately secured |
Execute arbitrary code
The adversary exploits the vulnerability that they have found and hijacks the running process.
| Technique |
|---|
| Scope | Likelihood | Impact | Note |
|---|
| Taxonomy Name | Entry ID | Entry Name |
|---|