13What are the common classes of Windows local privilege escalation, and how do you harden an estate against them?▼hardNewMicrosoftCrowdStrikePalo Alto Networks◆ premiumKernel exploits make headlines; misconfigured services, impersonation and stored credentials do the work. The scored answer groups escalation into classes and attaches a control and a detection to each.Open full answer →
47How does Windows run services and hold credentials in LSASS, and why are services and LSASS central to both attack and defence?▼mediumNewMicrosoftCrowdStrikePalo Alto Networks◆ premiumTwo things make Windows compromise spread: services that run with powerful identities, and a process that holds the credentials of everyone logged on.Open full answer →