Privilege escalation
Privilege escalation is gaining higher-level permissions than an account or process previously held, such as administrative rights or authority to perform a sensitive operation.
The important change is what becomes possible
An ordinary account becoming a local administrator is one example. Gaining authority over a particular application or sensitive function can matter too; escalation does not have to end with control of the entire organization.
MITRE ATT&CK describes attackers exploiting weaknesses, misconfigurations, and vulnerabilities to gain higher-level permissions. The question is what additional actions became available and whether that increase was authorized.
Moving to another computer is not automatically privilege escalation. Lateral movement concerns reaching other systems. A person can move between systems with the same level of access, or gain more authority without leaving the original system. Both can happen in the same intrusion.
Legitimate elevation needs context too
Administrators sometimes need temporary elevated access. Microsoft Entra Privileged Identity Management supports activating eligible roles subject to the organization’s configured requirements. An activation event therefore does not, on its own, establish malicious escalation.
Check the account, role, scope, timing, and basis for the request. Approval or activation also does not prove that the role was used. An eligible assignment, an active role, and an administrative operation are different observations.
The privileged-role activation article explains those distinctions. They are especially useful when a caller pressures an approver to authorize an urgent change: the request’s urgency does not establish the caller’s identity or the need for the privilege.