Attack paths and privilege escalation

Attackers rarely need a zero-day. They chain ordinary weaknesses (a reused credential, an over-broad permission, a trust relationship) until they reach something valuable. The defender's advantage is to map those paths before they are used.

BloodHound (Active Directory attack paths)PMapper / Prowler / Cloudsplaining (cloud IAM)PingCastleMITRE ATT&CKAtomic Red Teamprivilege access management (PAM)

The idea of a path

After initial access, an attacker looks for a route from where they are to what they want: higher privileges, other systems, sensitive data. Each step uses a permission, a stored credential, a trust or a misconfiguration. Seen as a graph, the environment has many such paths, and shortening or cutting them is the defender's job. This topic describes the concepts and the defenses, not step-by-step attack procedures.

Common building blocks

Credential exposure: passwords and tokens in files, scripts, memory, shell history and configuration, reused across systems.
Over-privilege: accounts and roles with far more permission than their task needs, including admins who log in to ordinary workstations.
Trust relationships: a system trusted by many others (a build server, a management host) becomes a pivot to all of them.
Weak service accounts: long-lived, highly privileged, with passwords that never rotate.
Misconfigured delegation or permissions: in Active Directory, in Kubernetes RBAC, and in cloud , where the right to pass or assume a role can be the right to become it.
Unpatched local flaws: a low-privileged foothold turning into administrator through a known vulnerability.

Example: a cloud permission that is more than it looks

A policy that lets a user pass any role to a compute service, combined with the right to create that service, lets the user run code as the most privileged role. The fix is to scope what can be passed.

risky-policy.jsonjson

{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow", "Action": ["iam:PassRole", "lambda:CreateFunction", "lambda:InvokeFunction"], "Resource": "*" }
  ]
}

scoped-policy.jsonjson

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "arn:aws:iam::123456789012:role/app-lambda-low-privilege",
      "Condition": { "StringEquals": { "iam:PassedToService": "lambda.amazonaws.com" } }
    },
    { "Effect": "Allow", "Action": ["lambda:CreateFunction", "lambda:InvokeFunction"], "Resource": "arn:aws:lambda:us-east-1:123456789012:function:app-*" }
  ]
}

Defending against chains

Map the paths yourself: run an attack-path tool (BloodHound for Active Directory, a cloud IAM analyzer for cloud) and treat the shortest paths to your as priority fixes.
Tiered administration: privileged accounts only log in to privileged systems, never to workstations or servers at a lower tier.
and just-in-time access: no standing admin rights, short elevations with approval and logging.
Protect and rotate credentials: secret managers, managed or group service accounts, no secrets in files.
Segment the network and reduce trust between systems; do not let one host reach everything.
Detect the steps: alert on privilege changes, new role assumptions, unusual authentication patterns and credential access.
Validate detection by emulating techniques safely (for example with Atomic ) in a lab or with approval.

IAMidentity and access managementThe set of policies, roles and credentials that says who every human, service or workload is, and what each one can do. In the cloud, IAM became the new perimeter: the network edge got porous, so identity carries the authorization.see in glossary →Crown jewelsThe assets whose loss or compromise would hurt the organization most. Strategy starts by identifying and protecting them.see in glossary →Least privilegeleast privilegeThe principle of giving each identity only the permissions strictly needed for its function, and nothing more. It is the opposite of 'admin user by default': every extra role is one more path an attacker can use after a compromise.see in glossary →Red teamAn objective-based, usually covert simulation of a realistic adversary that tests the organization's people, process and technology.see in glossary →

connections on the map

Web and API security testingcan lead toAttack paths and privilege escalation
Attack paths and privilege escalationis a step ofRed team, purple team and adversary emulation
Attack paths and privilege escalationis reported inReporting findings and driving remediation

updated on 14/10/2026 · sources to go deeper · report an error

in other domains

IAM - identity and accesscloudsecattack paths come from excess permissions

Study before

Unlocks

Red team, purple team and adversary emulation

test what you learned

Loading questions…