Privilege escalation

In August 2020, Microsoft patched Zerologon (CVE-2020-1472, CVSS 10), a Netlogon protocol flaw that let anyone with network access to a domain controller take it over without any credentials. On September 18, CISA issued Emergency Directive 20-04, giving federal agencies three days to patch. Within weeks, Ryuk ransomware operators were using it to go from a single endpoint to the whole domain. Privilege escalation is the step where an attacker who got in with limited rights obtains more than they were granted. MITRE ATT&CK treats it as a tactic of its own (TA0004). It is vertical when moving from a standard account to administrator or SYSTEM/root, horizontal when taking over the rights of another user at the same level. Common vectors: unpatched kernel flaws, overly broad sudo rules, misconfigured SUID binaries, access tokens never revoked, passwords left in scripts or environment variables. The concept carries over to AI agents, which a prompt injection can push into using tools or permissions outside their remit. For a cyber underwriter, this is the tipping point. A compromised endpoint is an incident; domain admin rights open the way to ransomware across the estate and large-scale exfiltration. Hence the questions on privileged access management (PAM), separate admin accounts and time to patch critical flaws.