# Source: https://docs.datadoghq.com/security/default_rules/def-000-g71.md

---
title: >-
  Trellix Endpoint Security unauthorized escalation of privilege was attempt
  detected
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Trellix Endpoint Security unauthorized
  escalation of privilege was attempt detected
---

# Trellix Endpoint Security unauthorized escalation of privilege was attempt detected

{% alert level="danger" %}
This rule is part of a beta feature. To learn more, [contact Support](https://docs.datadoghq.com/help/).
{% /alert %}
Classification:attackTactic:[TA0004-privilege-escalation](https://attack.mitre.org/tactics/TA0004)Technique:[T1068-exploitation-for-privilege-escalation](https://attack.mitre.org/techniques/T1068) 
## Goal{% #goal %}

Detect events where an unauthorized attempt to escalate privileges was blocked or identified by Trellix Endpoint Security.

## Strategy{% #strategy %}

Monitor for unauthorized attempts to gain higher levels of access or privileges on an endpoint. These events may indicate malicious activity, such as an attacker trying to elevate privileges to gain unauthorized control over systems, which could lead to further compromise or exploitation of sensitive data.

## Triage and Response{% #triage-and-response %}

1. Confirm the details of the privilege escalation attempt, including the user or process that initiated it.
1. Review the event details to understand the nature of the privilege escalation attempt, such as the method used.
1. Examine the impacted endpoint using its hostname - `{{@attributes.analyzerhostname}}` and IP address - `{{@attributes.analyzeripv4}}` to investigate potential vulnerabilities.
1. If the escalation attempt indicates a security threat, take immediate action to isolate the endpoint and perform a thorough investigation of potential unauthorized access.
1. Ensure that user privileges are correctly assigned and review existing security policies to prevent similar attempts in the future.