Privilege Escalation

1. Purpose & Scope

• Purpose:

  This playbook defines the response workflow for suspected or confirmed privilege escalation, including unauthorised elevation from standard user to administrator, abuse of privileged roles, local privilege escalation on endpoints, directory privilege escalation, cloud IAM escalation, service account abuse, and administrative policy tampering.

• Scope:

  Applies to privilege escalation activity across endpoints, servers, identity providers, Active Directory, cloud platforms, SaaS applications, and administrative tooling. This playbook should be run alongside related playbooks when escalation is part of account takeover, malware, lateral movement, cloud compromise, or data exfiltration.

2. Incident Identification & Criteria

Incident Type: Privilege Escalation

Trigger Conditions:

Initiate this playbook when any of the following occur:

• New or unexpected privileged role assignment
• User added to local admin, Domain Admin, cloud admin, SaaS admin, or other sensitive group
• Privileged session from an unusual source, device, region, or user agent
• UAC bypass, token impersonation, credential dumping, or privilege abuse alert
• Service account, workload identity, OAuth app, or API key granted excessive permissions
• IAM policy, group policy, conditional access, MFA, logging, or security control modified without approval
• Privileged tool execution from an unexpected endpoint or account
• Exploit activity resulting in higher privileges

Severity Levels:

3. Roles & Responsibilities

• Incident Commander: Coordinates response, approves containment timing, manages severity, and owns escalation decisions.
• Incident Responder / Forensic Analyst: Validates escalation activity, reconstructs the timeline, identifies affected accounts/assets, and preserves evidence.
• Communications Lead: Coordinates stakeholder updates and affected-user communications.
• Other Roles:
  • Identity & Access Team: Reviews role assignments, sessions, MFA, tokens, service accounts, and directory integrity.
  • Endpoint / Platform Team: Supports host evidence collection, isolation, rebuild, and endpoint control validation.
  • Cloud Security / Platform Team: Reviews cloud IAM, control plane activity, workload identities, and cloud containment actions.
  • Application / Service Owners: Validate whether privileged actions were authorised and support safe rollback.
  • Legal & Compliance: Assesses external notification requirements if sensitive data, regulated systems, or customers are affected.

4. Initial Actions

• Immediate Steps:

  • Validate the alert source and affected identity, host, role, or service.
    • 📘 RB-TRIAGE-003: Identity Alert Triage
    • 📘 RB-TRIAGE-002: EDR Alert Triage
    • 📘 RB-TRIAGE-011: Cloud Platform Alert Triage
  • Identify the privilege gained, source account, target system, timestamp, and whether activity is ongoing.
  • Notify the Incident Commander and engage identity, platform, or cloud owners as required.
    • 📘 SOP-001: Paging an Engineering Team's On-Call

  Decision Point:

  • If the activity is approved and expected → document rationale and close.
  • If unauthorised, suspicious, or unresolved → continue investigation and containment.

5. Investigation & Analysis

• Evidence Collection:

  • Collect identity, session, MFA, role assignment, audit, endpoint, and cloud control plane logs for the incident window.
    • 📘 RB-EVIDENCE-003: Identity & Authentication Log Acquisition
    • 📘 RB-EVIDENCE-002: Host-Based Log Acquisition
    • 📘 RB-EVIDENCE-004: Cloud Control Plane Log Acquisition
  • Capture memory where credential theft, token theft, LSASS access, or in-memory tooling is suspected.
    • 📘 RB-EVIDENCE-001: Memory Acquisition

• Analysis Steps:

  • Assess current and historical privileged access exposure.
    • 📘 RB-ANALYSIS-009: Privileged Access Assessment
  • Analyse authentication activity, MFA events, sessions, and privileged logons.
    • 📘 RB-ANALYSIS-007: Authentication Log Analysis
  • Review process trees, commands, LOLBins, and scripts involved in escalation attempts.
    • 📘 RB-ANALYSIS-006: Process Tree Analysis
    • 📘 RB-ANALYSIS-023: Command-Line Analysis
    • 📘 RB-ANALYSIS-024: LOLBin Abuse Investigation
    • 📘 RB-ANALYSIS-025: Script Execution Analysis
  • Validate whether the activity was authorised by the user, system owner, or change record.
    • 📘 RB-ANALYSIS-026: User Activity Validation
  • Identify additional compromised accounts, shared indicators, inherited privileges, and adjacent administrative relationships.
    • 📘 RB-ANALYSIS-011: Identify Additional Compromised Accounts
  • For cloud privilege escalation, reconstruct IAM, resource, region, and security-service activity.
    • 📘 RB-ANALYSIS-043: Cloud Control Plane Activity Analysis
  • Where exploit activity produced elevated access, verify exploitation and affected assets.
    • 📘 RB-ANALYSIS-041: Exploitation Verification
    • 📘 RB-ANALYSIS-035: Affected Asset Identification

  Decision Point: Run the post-detection phases (Analysis → Recovery) of any relevant sibling playbook concurrently alongside this one based on what was observed:

  • If account compromise is confirmed → execute PB-004: Account Takeover concurrently.
  • If malware is suspected or identified → execute PB-003: Endpoint Malware Infection concurrently.
  • If lateral movement is identified → execute PB-010: Lateral Movement concurrently.
  • If suspicious process/script execution is the primary signal → execute PB-011: Suspicious Execution concurrently.
  • If cloud compromise is suspected or identified → execute PB-007: Cloud Compromise concurrently.

6. Containment, Eradication & Recovery

• Containment Actions:

  • Disable or lock compromised accounts and remove unauthorised privileged assignments.
    • 📘 RB-CONTAIN-001: Account Lockdown
  • Revoke sessions, OAuth tokens, API tokens, refresh tokens, VPN sessions, and persistent sessions.
    • 📘 RB-CONTAIN-005: Session & Token Revocation
  • Reset MFA where factor registration, trusted devices, or MFA bypass is suspected.
    • 📘 RB-CONTAIN-006: MFA Reset & Validation
  • Contain directory-level risk where privileged Active Directory or domain control is affected.
    • 📘 RB-CONTAIN-003: Active Directory Containment
  • Isolate hosts or cloud workloads used to obtain or exercise elevated access.
    • 📘 RB-CONTAIN-004: Host Isolation
    • 📘 RB-CONTAIN-015: Cloud Workload Isolation

• Eradication Steps:

  • Remove unauthorised accounts, groups, roles, access keys, service principals, OAuth grants, policies, scheduled tasks, services, and persistence mechanisms.
  • Restore IAM, directory, conditional access, MFA, logging, and security control configurations to approved baselines.
  • Rotate credentials, secrets, certificates, API keys, and service account credentials that could have been exposed.

• Recovery Steps:

  • Restore user or administrative access only after containment and access integrity are validated.
    • 📘 RB-RECOVERY-003: User Recovery & Access Restoration
  • Rebuild or re-provision compromised systems where escalation involved host compromise or persistence.
    • 📘 RB-RECOVERY-002: Clean System Rebuild
  • Coordinate staged recovery for identity, cloud, or critical infrastructure impact.
    • 📘 RB-RECOVERY-001: Recovery & Restoration Coordination

7. Communication & Escalation

• Internal Communication:

  • Notify security leadership, identity owners, system owners, cloud/platform owners, and impacted business teams.
  • Use geo handoff for incidents spanning shifts.
    • 📘 SOP-002: Incident Handoff Between Geos
  • Notify affected users when credentials, MFA, or access restoration actions are required.
    • 📘 SOP-004: User Notification

• External Communication:

  • Engage Legal/Privacy if privileged access reached customer data, regulated data, production systems, or third-party environments.
    • 📘 SOP-003: Escalation, Legal & Executive Communications

• Escalation Criteria:

  Condition	Escalate To
  Compromised account caused escalation	PB-004: Account Takeover
  Lateral movement observed	PB-010: Lateral Movement
  Suspicious execution, LOLBin, or script abuse observed	PB-011: Suspicious Execution
  Malware suspected or identified	PB-003: Endpoint Malware Infection
  Cloud compromise suspected or identified	PB-007: Cloud Compromise
  Sensitive data access or exfiltration identified	PB-005: Data Exfiltration
  Domain-wide, tenant-wide, or security tooling compromise	PB-019: Major Security Incident Management

8. Post-Incident Activities

• Lessons Learned:

  • Conduct a Post-Incident Review (PIR)
  • Document what worked, what didn't, and what needs improvement
  • Review least privilege, just-in-time access, service account scope, and administrative segmentation.

• Documentation Updates:

  • Update this playbook, related runbooks, detections, access review procedures, and hardening guidance based on findings.

9. References & Linked Resources

• Playbooks:

  • PB-003: Endpoint Malware Infection
  • PB-004: Account Takeover
  • PB-005: Data Exfiltration
  • PB-007: Cloud Compromise
  • PB-010: Lateral Movement
  • PB-011: Suspicious Execution
  • PB-019: Major Security Incident Management

• Runbooks:

  • RB-TRIAGE-002: EDR Alert Triage
  • RB-TRIAGE-003: Identity Alert Triage
  • RB-TRIAGE-011: Cloud Platform Alert Triage
  • RB-EVIDENCE-001: Memory Acquisition
  • RB-EVIDENCE-002: Host-Based Log Acquisition
  • RB-EVIDENCE-003: Identity & Authentication Log Acquisition
  • RB-EVIDENCE-004: Cloud Control Plane Log Acquisition
  • RB-ANALYSIS-007: Authentication Log Analysis
  • RB-ANALYSIS-009: Privileged Access Assessment
  • RB-ANALYSIS-011: Identify Additional Compromised Accounts
  • RB-ANALYSIS-023: Command-Line Analysis
  • RB-ANALYSIS-024: LOLBin Abuse Investigation
  • RB-ANALYSIS-025: Script Execution Analysis
  • RB-ANALYSIS-026: User Activity Validation
  • RB-ANALYSIS-035: Affected Asset Identification
  • RB-ANALYSIS-041: Exploitation Verification
  • RB-ANALYSIS-043: Cloud Control Plane Activity Analysis
  • RB-CONTAIN-001: Account Lockdown
  • RB-CONTAIN-003: Active Directory Containment
  • RB-CONTAIN-004: Host Isolation
  • RB-CONTAIN-005: Session & Token Revocation
  • RB-CONTAIN-006: MFA Reset & Validation
  • RB-RECOVERY-001: Recovery & Restoration Coordination
  • RB-RECOVERY-002: Clean System Rebuild
  • RB-RECOVERY-003: User Recovery & Access Restoration

• SOPs:

  • SOP-001: Paging an Engineering Team's On-Call
  • SOP-002: Incident Handoff Between Geos
  • SOP-003: Escalation, Legal & Executive Communications
  • SOP-004: User Notification

10. Appendices

Contributor

Vishal Thakur GitHub: https://github.com/malienist

Contributed to the Arcana Incident Response Documentation Framework.