Technique:  Exploitation for Privilege Escalation
It has exploited CVE-2014-4076, CVE-2015-2387, CVE-2015-1701, CVE-2017-0263 to escalate privileges.
It has exploited CVE-2021-36934 to escalate privileges on a compromised host.
It has used CVE-2016-7255 to escalate privileges.
It has used a publicly available exploit for CVE-2017-0213 to escalate privileges on a local system.
It has exploited CVE-2021-1732 for privilege escalation.
During C0017, It abused named pipe impersonation for privilege escalation.
Carberp has exploited multiple Windows vulnerabilities (CVE-2010-2743, CVE-2010-3338, CVE-2010-4398, CVE-2008-1084) and a .NET Runtime Optimization vulnerability for privilege escalation.
It has used exploits to increase their levels of rights and privileges.
Cobalt Strike can exploit vulnerabilities such as MS14-058.
CosmicDuke attempts to exploit privilege escalation vulnerabilities CVE-2010-0232 or CVE-2010-4398.
Empire can exploit vulnerabilities such as MS16-032 and MS16-135.
It has used tools to exploit Windows vulnerabilities in order to escalate privileges. The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.
It has exploited the CVE-2016-0167 local vulnerability.
Hildegard has used the BOtB tool which exploits CVE-2019-5736.
InvisiMole has exploited CVE-2007-5633 vulnerability in the speedfan.sys driver to obtain kernel mode privileges.
JHUHUGIT has exploited CVE-2015-1701 and CVE-2015-2387 to escalate privileges.
It has exploited unpatched vulnerabilities on internally accessible servers including JIRA, GitLab, and Confluence for privilege escalation.
It has exploited CVE-2021-1732 to execute malware components with elevated rights.
Pandora can use CVE-2017-15303 to bypass Windows Driver Signature Enforcement (DSE) protection and load its driver.
It has leveraged a zero-day vulnerability to escalate privileges.
PoshC2 contains modules for local privilege escalation exploits such as CVE-2016-9192 and CVE-2016-0099.
ProLock can use CVE-2019-0859 to escalate privileges on a compromised host.
Remsec has a plugin to drop and execute vulnerable Outpost Sandbox or avast! Virtualization drivers in order to gain kernel mode privileges.
It has deployed a malicious kernel driver through exploitation of CVE-2015-2291 in the Intel Ethernet diagnostics driver for Windows (iqvw64.sys).
Siloscape has leveraged a vulnerability in Windows containers to perform an Escape to Host.
Stuxnet used MS10-073 and an undisclosed Task Scheduler vulnerability to escalate privileges on local Windows machines.
It has used CVE-2014-6324 and CVE-2017-0213 to escalate privileges.
It has exploited CVE-2019-0803 and MS16-032 to escalate privileges.
It has exploited vulnerabilities in the VBoxDrv.sys driver to obtain kernel mode privileges.
It has used an open-source tool to exploit a known Windows privilege escalation vulnerability (CVE-2016-0051) on unpatched computers.
Wingbird exploits CVE-2016-4117 to allow an executable to gain escalated privileges.
XCSSET has used a zero-day exploit in the ssh launchdaemon to elevate privileges and bypass SIP.
ItM has exploited CVE-2017-0005 for local privilege escalation.
Zox has the ability to leverage local and remote exploits to escalate privileges.