Privilege Escalation

Details


ID	PT0005
MITRE ATT&CK ID	TA0004
Created	2026-06-22
Last Modified	2026-06-22
Contributors	slashsec
Version Permalink	Link

Description

The adversary is trying to gain higher levels of physical access.

Privilege Escalation consists of techniques for moving from lower-trust areas or roles into restricted zones, unescorted access, or sensitive spaces. Examples include abusing escort procedures, exploiting misconfigured access groups, and leveraging stolen or forged credentials with broader permissions.

Techniques

ID	Name	Description
P0006	Tailgate	Adversaries may follow authorized personnel through controlled entry points without presenting their own credentials. Tailgating exploits courtesy holds, distraction, or high-traffic periods when doors and turnstiles remain open.
P0007	Social Engineering	Adversaries may manipulate people to obtain access, information, or assistance at a target facility. This includes impersonation, authority appeals, urgency, and other influence tactics at entry points, reception areas, or during escorted movement.
P0007.001	Exploit Business Process	Adversaries may exploit missing, ambiguous, or unenforced business processes to gain access or avoid scrutiny. Weak processes for visitor handling, deliveries, escorts, after-hours access, and contractor workflows can be abused through pretext, policy gaps, or inconsistent enforcement.
P0007.002	Impersonate Staff or Vendor	Adversaries may present themselves as employees, contractors, or vendor personnel to appear legitimate during entry and movement. Impersonation pairs with dress, tools, and behavior expected for the claimed role.
P0007.003	Pose as Visitor or Guest	Adversaries may act as visitors, interview candidates, guests, or event attendees to blend with normal foot traffic. Visitor pretexts often face lighter challenge at reception when appearance and behavior match expected patterns.
P0007.004	Employ Pretext in Conversation	Adversaries may use a prepared cover story when interacting with staff, security, or reception during operations. Consistent pretext in conversation reinforces legitimacy and deflects casual questions about purpose or destination.
P0007.005	Wear Cover Dress	Adversaries may wear clothing, uniforms, PPE, or accessories that match expected roles at the facility during live operations. Cover dress reduces scrutiny compared to out-of-place attire and supports blending with staff, vendors, or visitors.
P0007.006	Employ Pretext via Phone Calls	Adversaries may use a prepared cover story during phone calls to staff, security, reception, or help desks to obtain information or assistance without physical presence at the facility. Phone pretexts can elicit facility details, access procedures, or identities useful for planning and later tactics.
P0007.007	Employ Pretext via Email	Adversaries may use a prepared cover story in email to staff, contractors, or shared mailboxes to obtain information or assistance without physical presence at the facility. Email pretexts can request layouts, visitor procedures, or organizational details that support planning and later tactics.
P0008	Valid Credentials	Adversaries may use legitimate or previously valid credentials to enter controlled areas. This includes badges, keys, PINs, biometric enrollments, or access cards obtained through theft, sharing, cloning, or insider assistance.