After the break-in: privilege escalation, persistence and how defenders spot them

Getting in is rarely the attacker’s real goal. A first foothold, a phished account or one compromised app, usually has limited rights and can be lost at the next restart or password change. What follows is called post-exploitation: gaining more power, staying in place and moving towards the real objective. For defenders, this phase is also the best opportunity: attackers have to change things, and changes can be seen.

Privilege escalation

Privilege escalation means going from limited rights to higher ones, for example from a normal user to an administrator, or from an app’s sandbox to the wider system. MITRE ATT&CK lists privilege escalation as a tactic of its own, with techniques such as abusing mechanisms meant to elevate privileges, exploiting vulnerable software that runs with high rights, or reusing an administrator’s credentials found on the machine.

The defenses are mostly old-fashioned discipline: daily work on a standard account rather than an administrator account, prompt updates (many escalations exploit known, already-patched flaws), no passwords stored in plain text, and as few administrator accounts as possible. On macOS, System Integrity Protection means that even an administrator cannot modify protected system files, which removes a classic escalation target.

Persistence

Persistence means surviving a restart, a logout or a password change. MITRE ATT&CK’s persistence tactic catalogues dozens of ways to do it. On macOS, the most common are well documented: launch agents and launch daemons (configuration files that tell the system to start a program automatically), login items, and scheduled tasks. Because these mechanisms are legitimate and widely used by normal software, they are ideal hiding places.

Modern macOS notifies you when an app adds a background item, and lists them in one place. Anything you do not recognise, especially with a vague or misspelled name, deserves a closer look. The blog article on persistence hunting walks through these locations in more detail.

Lateral movement and exfiltration

With higher rights and a stable foothold, attackers move to other machines (lateral movement) and gather what they came for, then send it out (exfiltration). Both need the network. That is why defenders watch for unusual internal connections, new outgoing destinations and large, unexpected uploads, and why network visibility remains valuable even when an attacker controls a single machine well.

How defenders detect post-exploitation

• Alerts on new administrator accounts and on changes to security settings.
• Alerts on new persistence items, cross-checked against software the organisation actually deploys.
• Monitoring for processes running with unexpected privileges.
• Network monitoring for new destinations, unusual volumes and connections at odd hours.
• Mapping detections to MITRE ATT&CK to see which techniques you would catch and which you would miss.

Where FireAI fits

FireAI is not an antivirus and does not scan files or inspect persistence items. What it does is the network side of this picture on a Mac: it asks before a new or modified program connects, shows every app’s destinations on the world map, and its risk score counts factors such as a program’s first connection or unusual timing. A persistence item that phones home is exactly the kind of new, unexplained connection it surfaces, and in Paranoid mode unsigned apps are blocked outright.