detecting-privilege-escalation-attempts

By mukul975. Updated August 2, 2026. Categories: System Administration.

Detect privilege escalation attempts across Windows and Linux, including access token manipulation, UAC bypass, unquoted service path abuse, kernel exploits, and sudo/doas abuse. Use when threat hunting for T1068-style privilege escalation, triaging EDR/SIEM alerts on suspicious privilege changes, scoping compromise during incident response, or validating detection coverage in a purple team exercise.

View repository on GitHub

SKILL.md

The description above is the indexed summary. With JavaScript enabled, this page also loads the SKILL.md text from GitHub.