ARRANGEMENT AND METHOD OF PRIVILEGE ESCALATION DETECTION IN A HOST

Original (Chinese)

A method of privilege escalation risk detection in a host, such as a computer, and/or a network, such as a computer network, is disclosed. The method comprises: examining which executables are running in the host, searching, e.g. from a behavioral data source, behavioral information of the executables running in the host, performing a first identification phase for identifying executables running in the host which the behavioral information indicates are known to be run with an elevated privilege, performing a second identification phase by checking file access permissions to the executables identified in the first identification phase for identifying executables which are writable and/or modifiable by a privilege level lower than the elevated privilege, e.g. a privilege level other than administrator or system level privileges, and generating an alert for the executables identified in the second identification phase.