T1068
Exploitation for Privilege Escalation
Index entry
In-depth coverage of this technique (how it looks in telemetry, how to hunt it, and how to rule out benign activity) is coming soon. It's in our catalog and on the roadmap to be written up.
Telemetry needed
The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.
- containerd runtime events (the log as a whole)
- Linux audit framework (auditd)
- ACCESS
- SYSCALL:dmesg SYSCALL record for dmesg
- SYSCALL:execve SYSCALL record for execve
- macOS Endpoint Security framework events
- macOS unified log (the log as a whole)
- Windows Security event log
- 4672 Special privileges assigned to new logon.
- Sysmon