Skip to content

Exploitation for Privilege Escalation

Technique · ATTACK:enterprise:T1068

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1068",
  "title": "Exploitation for Privilege Escalation",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1068",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--b21c3b2d-02e6-45b1-980b-e69051040839",
  "external_id": "T1068",
  "domain": "enterprise",
  "created": "2017-05-31T21:30:55.066Z",
  "modified": "2025-10-24T17:49:14.643Z",
  "version": "1.6",
  "aliases": [

  ],
  "tactics": [
    "privilege-escalation"
  ],
  "source_references": [
    {
      "source_name": "ESET InvisiMole June 2020",
      "url": "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
    },
    {
      "source_name": "Microsoft Driver Block Rules",
      "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules"
    },
    {
      "source_name": "Unit42 AcidBox June 2020",
      "url": "https://unit42.paloaltonetworks.com/acidbox-rare-malware/"
    }
  ]
}

Explicit source assertions (49)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0942dc11-0fcd-480a-ae4d-d571ba96331b

SecureWorks BRONZE UNION June 2017 · Profero APT27 December 2020

ATTACK:enterprise:S1247 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0cdabb4e-45d7-4307-818e-0647c08a8b45

ESET Embargo Ransomware October 2024

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--131fde9c-7a83-4603-9c1e-c41f815fb14c

Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d6a8206-686c-4c52-b282-8580b3afacd5

BradyUnit42_TheGentlemen_July2026

ATTACK:enterprise:M1051 → mitigates → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22d11711-5794-42aa-a9c5-02895fe3420d

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--248b1bfc-5f9a-4f2c-ad6c-556045d9e83b

ATTACK:enterprise:M1050 → mitigates → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--267fa35c-7748-40eb-87ba-bddc0c88d643

TechNet Moving Beyond EMET · Wikipedia Control Flow Integrity

ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b28f78f-fc26-44cb-bf06-fb437252d97e

Microsoft Silk Typhoon MAR 2025

ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c880ffc-9fbb-4d19-bfff-72ad6320f003

Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d4edddf-2870-49cb-a7ee-026b8c09fe2e

ESET T3 Threat Report 2021

ATTACK:enterprise:S1151 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d61c23b-df1a-4d90-affa-b37a55b5e941

IBM ZeroCleare Wiper December 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3185e611-cec6-4910-aa64-efd8fafe1072

Unit42 AcidBox June 2020

ATTACK:enterprise:G0068 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d4737ca-bd18-4628-b453-9aed3f555c13

Microsoft PLATINUM April 2016

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--412a57f3-ce06-4790-8e3a-cb8c34b9e0f1

Cobalt Strike TTPs Dec 2017 · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4507ba2b-e23c-4acf-a6a3-5ed9dae8d590

Github PowerShell Empire

ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45626c7f-c401-427b-9589-c91a4b2a4f7f

FireEye Know Your Enemy FIN8 Aug 2016 · FireEye Fin8 May 2016

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5bd3526a-1ae2-4b09-8be7-0eef6ae33155

Group IB Cobalt Aug 2017

ATTACK:enterprise:S0664 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c60473c-6195-4aa1-ae10-394bb5f24cf1

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:M1048 → mitigates → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5edeca3e-96aa-45e6-b99b-044e25cb3245

Ars Technica Pwn2Own 2017 VM Escape

ATTACK:enterprise:S0484 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5fdf6cb3-8046-4c32-aca6-75cda70b7614

Prevx Carberp March 2011 · ESET Carberp March 2012

ATTACK:enterprise:S0050 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63f0007e-833e-4d6a-b79e-873525979f40

F-Secure The Dukes

ATTACK:enterprise:S1181 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--647eae34-69ab-4cc9-aa9e-44ff570d4fd2

Microsoft BlackByte 2023

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64fe312b-e489-4698-9924-aeb22c056e2b

ESET InvisiMole June 2020

ATTACK:enterprise:G1019 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--728302b6-f61c-40f1-9a78-926d785a3692

MoustachedBouncer ESET August 2023

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--736a8636-78f7-4ed7-80d4-73602eb32768

CISA AA24-038A PRC Critical Infrastructure February 2024

ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74e737cf-67fb-4f80-ac4e-0ddff90b6f8e

FireEye FIN6 April 2016

ATTACK:enterprise:G0107 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76681016-c8a2-4dcf-bac5-4a58749f326d

Symantec Whitefly March 2019

ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--81399eeb-a9f0-4e55-baed-2be3829962fe

DBAPPSecurity BITTER zero-day Feb 2021 · Microsoft CVE-2021-1732 Feb 2021

ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--976202db-cdfa-4c4e-bc09-9b3cad90e6fb

ESET Sednit Part 1 · ESET Sednit July 2015

ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9b7b3fc7-0151-4848-9b66-774eaf72561f

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a360e9a6-541f-4026-9d50-70aa288e49ec

MSTIC DEV-0537 Mar 2022

ATTACK:enterprise:S0623 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ae5fcb43-0f85-4c96-9b4b-65fe6a19e4fb

Unit 42 Siloscape Jun 2021

ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b26307f7-2d5a-4139-8333-e2c7a583f939

trendmicro xcsset xcode project 2020

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b61e2c68-4f0e-420d-8e58-989f8f3e83cd

Cisco BlackByte 2024

ATTACK:enterprise:S0672 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b9ed53b8-71a5-44a3-90d1-2fb600991674

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bfe6736d-9bda-4f6e-87f9-8e6f3364a915

CrowdStrike Scattered Spider BYOVD January 2023

ATTACK:enterprise:M1019 → mitigates → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c6615e27-5984-44b3-82dc-f710c6823834

ATTACK:enterprise:C0049 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc27e415-6fd8-410e-8469-888959cf5a27

CISA Leviathan 2024

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cce31baa-5862-4df5-806f-15aaa7410fa5

Microsoft SIR Vol 19 · Bitdefender APT28 Dec 2015 · Securelist Sofacy Feb 2018 · Nearest Neighbor Volexity

ATTACK:enterprise:G0128 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf752570-48f5-40b6-b448-b4bc009ae5df

Check Point APT31 February 2021

ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d8d1b814-2a28-402f-ab3b-f64c6d9974ce

TrendMicro Tonto Team October 2020

ATTACK:enterprise:S0654 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d910654b-9ebe-439e-b6f9-a8234bad7961

Group IB Ransomware September 2020

ATTACK:enterprise:S0176 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dbccbeab-26c9-476e-b529-c193f9796cbc

Microsoft SIR Vol 21

ATTACK:enterprise:C0045 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dd6e1e11-1022-4a67-9a4d-197a9dcf14dc

Oligo ShadowRay Campaign MAR 2024

ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dd9a12ee-30b1-4764-860d-111c73411ebe

Microsoft Driver Block Rules

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e0033e57-8839-42b9-8515-46e9c7dca966

FireEye APT32 May 2017

ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f72d9afb-4eb1-4030-9d91-938f80c4bf6e

FireEye APT33 Guardrail

ATTACK:enterprise:S0601 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f7e5f676-46e1-4241-b0bb-fb32d891896a

Unit 42 Hildegard Malware

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fac25fea-de44-41cd-b6e9-cd9dba5d880e

Trend Micro Earth Simnavaz October 2024

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.