MITRE ATT&CK Enterprise techniques whose primary tactic is Privilege Escalation: detection with open-source tooling and cyber range exercises.
Detecting T1068 Exploitation for Privilege Escalation on Containers, Linux, macOS and Windows, using telemetry such as Process Creation, Process Access and Module Load. Covers the ATT&CK mitigations Update Software and Execution Prevention and how to rehearse the detection in a cyber range.
Detecting T1546 Event Triggered Execution on Linux, macOS, Windows and SaaS and other platforms, using telemetry such as Process Creation, Command Execution and File Metadata. Covers its 18 sub-techniques, the ATT&CK mitigations Update Software and Privileged Account Management, and how to rehearse the detection in a cyber range.
Detecting T1548 Abuse Elevation Control Mechanism on Linux, macOS, Windows and IaaS and other platforms, using telemetry such as Process Creation, Logon Session Metadata and File Metadata. Covers its 6 sub-techniques, the ATT&CK mitigations Update Software and Execution Prevention, and how to rehearse the detection in a cyber range.
Detecting T1611 Escape to Host on Windows, Linux, Containers and ESXi, using telemetry such as Process Creation, OS API Execution and File Creation. Covers the ATT&CK mitigations Update Software and Execution Prevention and how to rehearse the detection in a cyber range.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.