Vulnerability Exploitation for Elevated Access

The subject exploits a vulnerability in an operating system, application, kernel component, service, driver, hypervisor, container runtime, or other privileged software to obtain permissions beyond their existing execution context.

This Sub-section applies as Preparation where exploitation increases the subject’s capability before a later infringement. Where the exploitation itself causes the principal harm, unauthorized modification, or operational disruption, investigators should also apply the relevant Infringement.