Intruder Tactics: Privilege Escalation

This document outlines what privilege escalation is, describes common attacker scenarios (local privilege escalation, exploitation to elevate to SYSTEM or local administrator, and progression to Domain Administrator), highlights tools and behaviours attackers use (mimikatz, Bloodhound), and recommends mitigations and monitoring steps such as enabling Credential Guard, restricting SeDebugPrivilege, and alerting on anomalous LDAP/file activity and Domain Administrators group changes.