Privilege Escalation: How It Works and How to Stop It

Written by Ruben Selby, Founder and Lead Security Consultant, Wolfcore. Last reviewed 11 November 2026.

Part of the Wolfcore Resources library: Hacking techniques explained.

In one sentence: Privilege escalation is when someone who can only do small things on a system finds a way to do bigger things, such as acting as an administrator.

What it is

Most break-ins start small: a phished staff account, a guessed password, a hijacked web login. That first account usually cannot change security settings or read everything. MITRE ATT&CK, the public catalogue of attacker behaviour, describes the tactic this way: adversaries can often enter and explore a network with unprivileged access but need elevated permissions to follow through on their objectives.

MITRE gives examples of the levels attackers aim for: SYSTEM or root, local administrator, a user account with admin-like access, and accounts with access to specific systems or functions. It adds that the common approaches are system weaknesses, misconfigurations and vulnerabilities.

Two directions are worth knowing. Vertical escalation moves up, from a normal user to an administrator. Horizontal escalation moves sideways, to another user’s data at the same level. Both are failures of access control.

How it works

Attackers follow one of three routes, and usually the easiest one.

A software flaw. A bug in the operating system, a driver or an application lets a low-privilege process run with higher rights. MITRE tracks this as exploitation for privilege escalation.
A misconfiguration. Accounts with more rights than they need, services running as administrator, shared admin passwords, or a user left in a local administrators group. MITRE also lists abuse of elevation controls and access token manipulation.
Better credentials. The attacker takes credentials that already have power. Cracked service account passwords are one example: MITRE notes that cracked Kerberoasting hashes may enable persistence, privilege escalation and lateral movement. See kerberos-authentication.

In web applications the same idea appears as broken access control. OWASP lists acting as an admin while logged in as a user, or reaching privileged pages as a standard user, and says access control is only effective in trusted server-side code, where the attacker cannot change the check.

A harmless illustration of the web pattern: if an app shows /invoice?id=123 and trusts the number without checking who owns it, changing the number shows someone else’s invoice. The fix is to check ownership on the server every time:

# Vulnerable: trusts the id sent by the browser
invoice = db.get(request.id)

# Fixed: checks that the invoice belongs to the signed-in user
invoice = db.get(request.id)
if invoice.owner != current_user.id:
    deny()

Who it affects and how badly

Sole trader to 10 staff: if everyone is a local administrator, one infected laptop can change security settings and disable protection. Worst case is a locked laptop and a stolen email account.
10 to 50 staff (accountancy, legal, recruitment, construction): staff with admin rights on a server estate can turn one phished account into access to every client folder.
50 to 250 and 250 plus (schools, councils, manufacturers, care providers, SaaS, fintech and telecoms): escalation to domain or cloud admin is the step that turns a single compromised account into ransomware, data theft and regulator involvement in the UK, EU, US and Armenia.

Real examples

Microsoft’s November 2026 Patch Tuesday. Coverage of the release counted 535 elevation of privilege flaws out of 1,093 newly released vulnerabilities, with 15 of the 63 Critical flaws being privilege escalation, including eight in Hyper-V. Escalation bugs are routine in monthly updates, which is why patching speed matters.
Cyber Essentials’ own example. The NCSC scheme document describes “Jody”, logged in as an administrator, who opens a malicious attachment; the malware gets administrative privileges and ransomware encrypts far more data than standard rights would allow.

Worked example for a small business (illustration only)

An invented example, not a real client. A 15-person architects’ practice gives every employee local administrator rights so they can install drawing plug-ins. A designer opens a booby-trapped email attachment. The malware runs as an administrator, switches off the antivirus and reaches the shared drive. The practice loses a week of drawings, pays for a rebuild and has to tell two clients. The fix is standard accounts for daily work, an admin account used only when needed, and an allow-list of approved software.

How to detect it

Alert when anyone is added to administrator groups or a new Global Administrator appears in Microsoft 365. MITRE notes attackers may add a new global administrator in Office 365 environments.
On Windows, watch logon events for special privileges being assigned (Security event 4672) alongside unusual logons (4624 and 4648). MITRE’s Kerberoasting detection strategy uses the same events.
Log and review authentication and authorisation events. The NCSC advises logging and monitoring them for failed MFA steps, unexpected locations and password guessing.
Review the list of local administrators on laptops and servers every quarter.
In web applications, log access-control failures and alert on repeats, as OWASP advises.

How to fix or prevent it

Remove everyday admin rights. Cyber Essentials requires separate accounts to perform administrative activities only, with no email or web browsing.
Apply least privilege. The NCSC advises a tiered model and using full-privilege accounts only when absolutely necessary.
Patch within 14 days for critical and high-risk fixes, as Cyber Essentials requires, and faster when a flaw is exploited.
Use MFA on all admin accounts, ideally a hardware security key.
Use long random passwords or managed service accounts for service accounts.
Review privileges regularly and remove them when someone changes role.
Allow-list approved applications so malware that arrives cannot simply run.
For web apps, deny by default and enforce permissions on the server, as OWASP advises.
Segment networks and monitor, as the NCSC lateral movement guidance advises.

What we check on a test

Whether a standard user account can reach administrator or SYSTEM through weak permissions, services or scheduled tasks on a workstation or server.
Which accounts have admin rights, how they are used and whether admin and daily accounts are separate.
Service account privilege and password strength.
In web applications, whether a normal user can reach admin functions or other users’ records by changing requests.
Cloud role assignments in Microsoft 365 and similar platforms.
Whether patches, and logging of privilege use, would stop or reveal an attacker.

The UK angle

The NCSC’s lateral movement guidance says attackers who have a foothold escalate their privileges to take control of a target such as a domain controller, and recommends separate admin accounts, least privilege, patching and monitoring. Cyber Essentials writes several of these into its user access control and update management requirements, so privilege hygiene is part of what an assessor checks.

Frequently asked questions

Is privilege escalation the same as hacking in? No. It is what happens after someone is in, when they widen what they can do.

What is the difference between vertical and horizontal escalation? Vertical escalation gains higher rights, such as admin. Horizontal escalation reaches other users’ data at the same level.

What is the most effective defence? Least privilege plus quick patching. Cyber Essentials requires separate admin accounts and 14-day updates for critical fixes.

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.

How privilege escalation works: from ordinary account to administrator