Benchmark: TA0004 Privilege Escalation
Overview
Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. Examples of elevated access include:
- SYSTEM/root level
- local administrator
- user account with admin-like access
- user accounts with access to specific system or perform specific function
- These techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.
Usage
Install the mod:
mkdir dashboardscd dashboardspowerpipe mod initpowerpipe mod install github.com/turbot/tailpipe-mod-github-audit-log-detectionsStart the Powerpipe server:
powerpipe serverOpen http://localhost:9033 in your browser and select TA0004 Privilege Escalation.
Run this benchmark in your terminal:
powerpipe benchmark run github_audit_log_detections.benchmark.mitre_attack_v161_ta0004Snapshot and share results via Turbot Pipes:
powerpipe benchmark run github_audit_log_detections.benchmark.mitre_attack_v161_ta0004 --share