Arrangement and method of privilege escalation detection in a computer or computer network

An arrangement for privilege escalation detection in a computer or computer network, the arrangement comprising:

• at least one computer comprising circuitry configured to:
• examine which executables are running in a target host,
• search, from a behavioral data source, behavioral information of the executables running in the target host,
• include, in a first list, identification information of executables running in the target host which the behavioral information indicates are known to run with a first- or a higher-level privilege,
• include, in a second list, identification information of sensitive resources loaded or executed by the executables included in the first list,
• examine the sensitive resources included in the second list to determine whether that resource is writable by an executable running at a privilege level lower than the first level by examining resources existing in the target host, and comparing the examined resources with the sensitive resources in the second list to determine which ones of the resources existing in the target host may be vulnerable, and
• provide an indication of every resource that is loaded by the first- or higher-level privilege executable but is writable by the executable running at a privilege level lower than the first level as a potential vulnerability.

A non-transitory computer-readable medium comprising a computer program comprising instructions which, when executed by a computer, cause the computer to:

• examine which executables are running in a target host;
• search, from a behavioral data source, behavioral information of the executables running in the target host;
• include, in a first list, identification information of executables running in the target host which the behavioral information indicates are known to run with a first- or a higher-level privilege;
• include, in a second list, identification information of sensitive resources loaded or executed by the executables included in the first list;
• examine the sensitive resources included in the second list to determine whether that resource is writable by an executable running at a privilege level lower than the first level by examining resources existing in the target host, and comparing the examined resources with the sensitive resources in the second list to determine which ones of the resources existing in the target host may be vulnerable;
• and
• provide an indication of every resource that is loaded by the first- or higher-level privilege executable but is writable by the executable running at a privilege level lower than the first level as a potential vulnerability.

An apparatus for privilege escalation detection in a computer or computer network, the apparatus comprising:

• one or more processors configured to:
• examine which executables are running in a target host,
• search, from a behavioral data source, behavioral information of the executables running in the target host,
• include, in a first list identification, information of executables running in the target host which the behavioral information indicates are known to run with a first- or a higher-level privilege,
• include, in a second list identification, information of sensitive resources loaded or executed by the executables included in the first list,
• examine the sensitive resources included in the second list to determine whether that resource is writable by an executable running at a privilege level lower than the first level by examining resources existing in the target host, and comparing the examined resources with the sensitive resources in the second list to determine which ones of the resources existing in the target host may be vulnerable, and
• provide an indication of every resource that is loaded by the first- or higher-level privilege executable but is writable by the executable running at a privilege level lower than the level first as a potential vulnerability.