Detecting Privilege Escalation Attempts
FreeProactively hunt for privilege escalation indicators.
Free · Opens the source repo
What Detecting Privilege Escalation Attempts does
Detecting Privilege Escalation Attempts is a Python-based skill designed for cybersecurity professionals focused on identifying and mitigating threats associated with privilege escalation. This skill is particularly useful for threat hunters, incident responders, and security analysts who need to monitor and analyze potential security breaches in both Windows and Linux environments. By leveraging this skill, users can efficiently detect various techniques employed by attackers, such as access token manipulation, UAC bypass, and unquoted service path abuse, among others.
The skill operates by integrating with existing EDR and SIEM platforms, requiring telemetry and log data from systems like CrowdStrike, Splunk, and Sysmon. Users can formulate hypotheses based on threat intelligence and execute detection queries to gather relevant event data. The structured workflow allows for thorough analysis and validation of findings, ensuring that security teams can distinguish between genuine threats and false positives effectively. This proactive approach to threat hunting is essential for maintaining robust security postures in organizations.
In addition to its detection capabilities, the skill provides a framework for documenting and reporting findings, which is crucial during incident response and security assessments. By correlating detected activities with known attack patterns and techniques from the MITRE ATT&CK framework, users can enhance their understanding of threat actor behaviors and improve their overall detection coverage. This skill is an invaluable asset for teams engaged in purple team exercises, where collaboration between offensive and defensive security practices is paramount.
When to use it
Use this skill during threat hunting, incident response, or security assessments when investigating privilege escalation techniques.
When not to use it
It may not be suitable for environments lacking the necessary EDR or SIEM infrastructure.
What you can build with it
Hunting for UAC Bypass
Utilize the skill to identify attempts to bypass User Account Control during security assessments.
Investigating EDR Alerts
Respond to alerts from EDR platforms by running detection queries to validate suspicious privilege changes.
Assessing Incident Response Capabilities
Use the skill during incident response to scope potential compromises related to privilege escalation.
How to install Detecting Privilege Escalation Attempts
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/detecting-privilege-escalation-attempts --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Detecting Privilege Escalation Attempts
When to Use
- When proactively hunting for indicators of detecting privilege escalation attempts in the environment
- After threat intelligence indicates active campaigns using these techniques
- During incident response to scope compromise related to these techniques
- When EDR or SIEM alerts trigger on related indicators
- During periodic security assessments and purple team exercises
Prerequisites
- EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)
- SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)
- Sysmon deployed with comprehensive configuration
- Windows Security Event Log forwarding enabled
- Threat intelligence feeds for IOC correlation
Workflow
- Formulate Hypothesis: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.
- Identify Data Sources: Determine which logs and telemetry are needed to validate or refute the hypothesis.
- Execute Queries: Run detection queries against SIEM and EDR platforms to collect relevant events.
- Analyze Results: Examine query results for anomalies, correlating across multiple data sources.
- Validate Findings: Distinguish true positives from false positives through contextual analysis.
- Correlate Activity: Link findings to broader attack chains and threat actor TTPs.
- Document and Report: Record findings, update detection rules, and recommend response actions.
Key Concepts
| Concept | Description |
|---|---|
| T1134 | Access Token Manipulation |
| T1548.002 | UAC Bypass |
| T1068 | Exploitation for Privilege Escalation |
| T1574.009 | Unquoted Service Path |
Tools & Systems
| Tool | Purpose |
|---|---|
| CrowdStrike Falcon | EDR telemetry and threat detection |
| Microsoft Defender for Endpoint | Advanced hunting with KQL |
| Splunk Enterprise | SIEM log analysis with SPL queries |
| Elastic Security | Detection rules and investigation timeline |
| Sysmon | Detailed Windows event monitoring |
| Velociraptor | Endpoint artifact collection and hunting |
| Sigma Rules | Cross-platform detection rule format |
Common Scenarios
- Scenario 1: Potato exploit for SYSTEM token impersonation
- Scenario 2: Fodhelper.exe UAC bypass technique
- Scenario 3: PrintSpoofer privilege escalation from service to SYSTEM
- Scenario 4: CVE kernel exploit for local privilege escalation
Output Format
Hunt ID: TH-DETECT-[DATE]-[SEQ]
Technique: T1134
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]
Frequently asked questions about Detecting Privilege Escalation Attempts
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.