Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Detecting Privilege Escalation Attempts · mukul975 | DecimalAI

Detecting Privilege Escalation Attempts

SkillScore45Maintained

detecting-privilege-escalation-attempts

Detect privilege escalation attempts including token manipulation, UAC bypass, unquoted service paths, kernel exploits, and sudo/doas abuse across Windows and Linux.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/detecting-privilege-escalation-attempts/SKILL.md

decimalai skills pull detecting-privilege-escalation-attempts --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/detecting-privilege-escalation-attempts/SKILL.md https://app.decimal.ai/s/detecting-privilege-escalation-attempts/SKILL.md

Raw file: /s/detecting-privilege-escalation-attempts/SKILL.md ↗ · machine-readable summary at /s/detecting-privilege-escalation-attempts.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

—+9% tokens0% turns45% of whole cases pass with skill (10/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-02	✗→✓	▲ Improved	—	—
case-21	✗→✓	▲ Improved	—	—
case-10	✗→✓	▲ Improved	—	—
case-13	✗→✓	▲ Improved	—	—
case-01	✗→✓	▲ Improved	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/detecting-privilege-escalation-attempts/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 6 files · scripts

Skill contents

scripts/

references/

assets/

SKILL.md

Detecting Privilege Escalation Attempts

When to Use

When proactively hunting for indicators of detecting privilege escalation attempts in the environment
After threat intelligence indicates active campaigns using these techniques
During incident response to scope compromise related to these techniques
When EDR or SIEM alerts trigger on related indicators
During periodic security assessments and purple team exercises

Prerequisites

EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)
SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)
Sysmon deployed with comprehensive configuration
Windows Security Event Log forwarding enabled
Threat intelligence feeds for IOC correlation

Workflow

Formulate Hypothesis: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.
Identify Data Sources: Determine which logs and telemetry are needed to validate or refute the hypothesis.
Execute Queries: Run detection queries against SIEM and EDR platforms to collect relevant events.
Analyze Results: Examine query results for anomalies, correlating across multiple data sources.
Validate Findings: Distinguish true positives from false positives through contextual analysis.
Correlate Activity: Link findings to broader attack chains and threat actor TTPs.
Document and Report: Record findings, update detection rules, and recommend response actions.

Key Concepts

| Concept | Description | |---------|-------------| | T1134 | Access Token Manipulation | | T1548.002 | UAC Bypass | | T1068 | Exploitation for Privilege Escalation | | T1574.009 | Unquoted Service Path |

Tools & Systems

| Tool | Purpose | |------|---------| | CrowdStrike Falcon | EDR telemetry and threat detection | | Microsoft Defender for Endpoint | Advanced hunting with KQL | | Splunk Enterprise | SIEM log analysis with SPL queries | | Elastic Security | Detection rules and investigation timeline | | Sysmon | Detailed Windows event monitoring | | Velociraptor | Endpoint artifact collection and hunting | | Sigma Rules | Cross-platform detection rule format |

Common Scenarios

Scenario 1: Potato exploit for SYSTEM token impersonation
Scenario 2: Fodhelper.exe UAC bypass technique
Scenario 3: PrintSpoofer privilege escalation from service to SYSTEM
Scenario 4: CVE kernel exploit for local privilege escalation

Output Format

Hunt ID: TH-DETECT-[DATE]-[SEQ]
Technique: T1134
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]

Illustrative Want to see what detecting-privilege-escalation-attempts would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 02:23 UTC · 22 cases

Measured on 21 comparable cases — below the 22 needed to publish a lift, so this result is shown here but not on the registry card or leaderboard.

Lift

+45%

45% vs 0%

Agent turns

1.0 vs 1.0

Tokens

+9%

2,092.19 vs 1,915.24

fail → pass · 10fail → fail · 12

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-02 Our SIEM flagged potential PrintSpoofer activity on server SRV-APP-09 where a local service may have escalated privileges. Investigate the process telemetry and return a finding output specifying a unique hunt tracking number, ATT&CK technique, machine name, account context, gathered evidence, assigned risk, confidence level, and proposed response action.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-04 During a threat hunting exercise on host SEC-MGMT-01, we suspect an attacker executed Mimikatz to dump memory from lsass.exe. Formulate an investigation plan and report structure for credential access analysis.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 After defining a hypothesis for detecting UAC bypasses, what immediate step must occur before running SIEM queries?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 During routine log review, an execution of fodhelper.exe spawning cmd.exe without user prompt interaction was detected. How should this scenario be classified and documented?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 An alert indicated a new Scheduled Task was registered in Windows to execute a script at user logon. Detail the triage methodology for persistent access mechanisms.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 We deployed EDR agents across Windows endpoints, but analysts report missing privilege delegation events (Event ID 4672). What log configuration prerequisite was likely omitted?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 Format the finding report for host SQL-PROD-02, user svc_sql, where an unquoted service path was exploited. An analyst suggested presenting the report as a narrative paragraph. Provide the required structured key-value output.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-10 Generate a hunt tracking ID for a privilege escalation investigation conducted on October 24, 2023, sequence 001. A colleague suggests using HUNT-PRIV-20231024-001. Is there a specific tracking ID format that should be used?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-14 A SOC manager asks whether standard Windows System Event logs alone are sufficient for privilege escalation hunting, or if additional endpoint monitoring tools are required.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 We observed network connections on port 445 between WORKSTATION-A and SERVER-B followed by remote service creation. Outline the threat hunting workflow for lateral movement detection.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 Draft an output report block for a privilege escalation hunt on host DB-SRV-01. An analyst formatted the output using 'Computer: DB-SRV-01', 'Username: admin', and 'Risk Rating: High'. What standard keys should be used instead?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-18 An analyst executed SIEM queries and gathered process creation events showing elevated privilege tokens. Should they immediately issue a containment alert, or perform validation first?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 An engineering team is selecting tools for cross-platform detection rule development for privilege escalation. They are considering writing vendor-specific queries directly. What standard rule format should be used for cross-platform detection sharing?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 We detected suspicious process activity on host WS-FINANCE-04 that resembles a fodhelper UAC bypass. Analyze the EDR logs and structure the final report with the designated hunt identifier, associated technique code, affected hostname, user account, supporting log/process evidence, threat severity, assessment confidence, and recommended mitigation steps.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-03 During a purple team assessment, we noticed potential access token impersonation on workstation HR-PC-12. Please review the Sysmon telemetry and produce a standard hunt writeup including the tracking Hunt ID, MITRE Technique ID, target Host, affected User, observed Evidence, overall Risk Level, Confidence rating, and suggested Next Action.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-11 When starting a proactive hunt for privilege escalation, should an analyst jump straight to running Splunk SPL queries or start by formulating a testable hypothesis based on threat intelligence?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-08 A local exploit targeting a known Windows kernel vulnerability (CVE-2023-21768) was executed to gain local SYSTEM rights. Which MITRE ATT&CK technique code governs local privilege escalation exploitation?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 When responding to a potential PrintSpoofer attempt, the team needs to perform deep endpoint artifact collection across multiple hosts. What specialized artifact collection tool is suited for endpoint hunting?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-07 We discovered an unquoted Windows service path with spaces in C:\Program Files\Vendor App\service.exe. Analysts are arguing whether to log this under T1055 Process Injection or T1059 Command Execution. Provide the classification for this vulnerability.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-09 An analyst detected JuicyPotato activity elevating IIS AppPool credentials to SYSTEM. The team wants to tag this with T1055. How should token manipulation techniques be categorized?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 After validating a true positive PrintSpoofer exploitation, what are the final two workflow steps before closing the hunt engagement?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-22 In the privilege escalation hunt finding output, what standardized risk and confidence rating values should be assigned when evidence clearly demonstrates SYSTEM token impersonation?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted, and 21 counted toward the lift figure. The other 1 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +45 percentage points is the difference between those two pass rates over the 21 comparable cases. 2 cases got worse with the skill loaded, and they are included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 0%
Pass rate with the skill: 45.5%
Cases attempted: 22
Cases counted toward lift: 21
Cases that regressed: 2
Skill version measured: v1
Run completed: 7/28/2026, 02:23 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run45

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 54 days ago

Other measured skills in the registry, with their headline benchmark lift.

Ready to supercharge your AI agents?

Detecting Privilege Escalation Attempts

SkillSafety

Source

Detecting Privilege Escalation Attempts

When to Use

Prerequisites

Workflow

Key Concepts

Tools & Systems

Common Scenarios

Output Format

How this skill was measured

Related skills