Skill UI

Workflow for hunting privilege escalation attempts across Windows and Linux, leveraging EDR/SIEM telemetry to identify token manipulation, UAC bypasses, unquoted service paths, kernel exploits, and sudo/doas abuse.

Performs privilege escalation assessments on compromised Linux and Windows hosts to trace paths from low-privilege shells to root/SYSTEM control. Enumerates misconfigurations, SUID binaries, kernel exploits, and credential stores so testers can demonstrate escalation impact and validate controls like least-privilege policies and EDR detections.

Guides red teams through enumerating SUID binaries, sudo misconfigurations, kernel exploits, cron abuses, capability misuse, and writable services to escalate privileges on Linux systems and document successful vectors.