Detecting exploitation for privilege escalation (T1068)

What is T1068 — Exploitation for privilege escalation?

MITRE ATT&CK® T1068 describes a technique where adversaries exploit software vulnerabilities in the operating system kernel, a device driver, a running service, or installed software to gain privileges higher than their current account holds. The goal is SYSTEM-level access on Windows or root on Linux, unlocking capabilities unavailable to standard users: installing kernel drivers, reading protected memory, disabling security controls.

Unlike credential-based escalation, T1068 requires a vulnerable target. The attacker must identify a locally exploitable CVE applicable to the victim's OS version and patch level, then deliver and execute an exploit either manually or as a stage in post-exploitation tooling such as Metasploit or custom shellcode. Pre-built detection rules mapped to T1068 behavioral indicators are the most resilient way to catch exploitation attempts regardless of the specific CVE involved.

How attackers use T1068

The T1068 attack flow follows a consistent pattern, regardless of the specific exploit used. MITRE ATT&CK framework documentation for this technique provides additional sub-technique context and real-world procedure examples from tracked threat actor groups:

1. Enumerate patch level and OS version: The attacker runs systeminfo, checks WMIC qfe for installed hotfixes, or uses post-exploitation tools like WinPEAS/LinPEAS to identify missing patches and potentially exploitable misconfigurations.
2. Select an applicable exploit: The attacker matches discovered vulnerabilities against their exploit toolkit. Exploit-DB, GitHub, or private exploit brokers are common sources for local privilege escalation exploits.
3. Execute the exploit: The exploit is delivered as a binary, script, or reflective DLL. Execution typically spawns a new process often cmd.exe or powershell.exe inheriting SYSTEM token privileges.
4. Establish SYSTEM-level persistence: With SYSTEM access, the attacker installs a malicious service, modifies a kernel driver, or adds themselves to the local administrators group to maintain the elevated access.

Detection indicators for T1068

T1068 is among the harder techniques to detect because kernel exploitation often leaves minimal log footprint. Detection is most effective when focused on behavioral indicators before and after exploitation rather than exploit signatures. A modern SOC toolset combining SIEM correlation with endpoint telemetry provides the best coverage for T1068 detection across the exploitation lifecycle.

Pre-exploitation indicators

• Privilege Enumeration: Commands like whoami /priv, systeminfo, or WMIC qfe list executed from unusual parent processes (e.g., spawned by a web application) indicate active privilege reconnaissance.
• WinPEAS / LinPEAS execution: These enumeration tools have known signatures and behavioral patterns (e.g., looping through registry hives, checking service permissions, accessing shadow copies).

Exploitation indicators (process lineage)

The most reliable T1068 indicator is an anomalous parent-child process relationship specifically, a critical system process (wininit.exe, services.exe, csrss.exe) spawned by an unexpected parent, or a high-privilege process (running as SYSTEM) with a non-privileged parent. Log360's pre-built rule Suspicious parent spawning wininit/services/csrss (Critical severity) targets exactly this pattern.

Post-exploitation indicators

• Kernel driver installation: T1068 exploits, particularly BYOVD attacks, install vulnerable or malicious kernel drivers. Event ID 7045 (new service installed) and Sysmon Event ID 6 (driver load) with an unsigned or low-reputation driver are high-fidelity indicators. Correlate with log analysis of the process chain immediately preceding the driver load for complete attack chain reconstruction.
• New service creation with SYSTEM token: After exploitation, attackers often immediately create a new service (Event ID 4697) to establish SYSTEM-level persistence.
• Token privilege expansion: Process creation (Event ID 4688) with TokenElevationTypeFull for a process whose parent was running at standard user level indicates successful privilege token manipulation.

Log360 detection rules for T1068

Log360 ships with pre-built correlation rules that address the behavioral indicators of T1068 exploitation. Because T1068 does not have CVE-specific rule coverage (signatures would be brittle and easily bypassed), Log360's approach focuses on process behavior, driver activity, and service creation patterns:

Investigation steps

When Log360 fires a T1068-related alert, follow this investigation sequence to confirm the exploit, scope the damage, and identify the root cause:

1. Examine the full process chain: In Log360's Process Lineage view, trace the alert's source process back to its ancestor chain. Identify where the privilege elevation occurred which process transitioned from low to high privilege without a legitimate elevation request (UAC).
2. Check the kernel driver: If a kernel driver installation is involved (Event ID 7045 or Sysmon ID 6), extract the driver binary path. Verify whether the driver is signed, check the publisher, and cross-reference against known malicious driver hashes. Unsigned drivers in Temp, AppData, or unusual paths are immediate red flags.
3. Correlate with network logs: Was the exploit delivered remotely? Check for network connections immediately preceding the process chain anomaly. A connection from an unexpected external IP to an internal service, followed by an exploit chain, points to remote T1068 exploitation.
4. Assess privilege scope after escalation: What actions did the SYSTEM-level process perform? Check for subsequent file writes, registry modifications, credential access attempts, or lateral movement (remote logons to other systems). This determines the full blast radius.
5. Identify the exploited vulnerability: Check the Windows version and installed patches (Event ID 4688 metadata, or raw systeminfo output from the affected host). Correlate the behavior with known CVEs for that OS version and patch level to identify the specific vulnerability exploited.

Response playbook

• Isolate the host immediately: Remove the affected system from the network via EDR quarantine or VLAN reassignment to prevent lateral movement from the SYSTEM-level session.
• Stop and remove malicious drivers/services: Disable and unload any suspicious kernel drivers. Remove malicious services created post-exploitation. Do not simply stop the service fully remove it and delete the binary.
• Preserve forensic evidence: Before reimaging, capture a full memory dump (SYSTEM-level access enables comprehensive memory acquisition), export relevant event logs, and hash all suspicious files. This evidence is essential for CVE attribution and insurance claims.
• Apply the relevant security patch: Identify the exploited CVE and apply the Microsoft Security Update or vendor patch. If the patch is not immediately available (zero-day), implement compensating controls: Windows Defender Application Control (WDAC) blocking unsigned drivers, or AppLocker restricting execution from temp folders.
• Reset credentials on the affected host: Any credentials cached on a SYSTEM-compromised host should be treated as exposed. Rotate local admin passwords (LAPS), service account passwords, and any interactive credentials used on the system.
• Threat hunt for lateral movement: With SYSTEM access, attackers can dump credentials and move laterally. Run a threat hunt for logons from the affected host to other systems in the same timeframe as the T1068 exploitation window. Use threat intelligence enrichment to identify if the observed TTPs match a tracked adversary group.

Explore related privilege escalation detection guides

Frequently asked questions