Privilege Escalation

• T1548: Abuse Elevation Control Mechanism

• T1134: Access Token Manipulation

• T1055: Process Injection

• T1068: Exploitation for Privilege Escalation

• T1078: Valid Accounts

• T1547: Boot or Logon Autostart Execution

• T1546: Event Triggered Execution

• T1556: Modify Authentication Process

• T1574: Hijack Execution Flow

• T1037: Boot or Logon Initialization Scripts