Attack scenario
Privilege escalation and persistence
An adversary expands privileges, creates or modifies accounts and policies, and establishes repeatable access to systems, identities, or cloud environments.
Why this scenario matters
After initial compromise, the adversary attempts to move from limited access to privileged control and survive a reboot, password change, or removal of the original entry point. Persistence may exist in the operating system, directory, tenant, or application integration.
The scenario shows why login protection alone is insufficient: PAM, IGA, privilege governance, change auditing, endpoint detection, and tenant-policy controls are also required.
The scenario uses MITRE ATT&CK® as a reference model. It is an expert SecTec interpretation and does not imply endorsement by MITRE.
Relevant ATT&CK tactics
- Credential Access
- Defense Impairment
- Execution
- Initial Access
- Persistence
- Privilege Escalation
- Stealth
Relevant ATT&CK techniques
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1078 Valid Accounts
- T1098 Account Manipulation
- T1136 Create Account
- T1484 Domain or Tenant Policy Modification
- T1556 Modify Authentication Process
- T1053 Scheduled Task/Job
- T1543 Create or Modify System Process
- T1547 Boot or Logon Autostart Execution
- T1055 Process Injection
SecTec technologies and vendors
The following hierarchy is derived from the approved ATT&CK-to-technology and technology-to-vendor mappings.