detecting-privilege-escalation-attempts

name	detecting-privilege-escalation-attempts
description	Detect privilege escalation attempts across Windows and Linux, including access token manipulation, UAC bypass, unquoted service path abuse, kernel exploits, and sudo/doas abuse. Use when threat hunting for T1068-style privilege escalation, triaging EDR/SIEM alerts on suspicious privilege changes, scoping compromise during incident response, or validating detection coverage in a purple team exercise.
domain	cybersecurity
subdomain	threat-hunting
tags	["threat-hunting","mitre-attack","privilege-escalation","token-manipulation","uac-bypass","proactive-detection"]
version	1.0
author	mahipal
license