Domain 3 · Blueprint topic (academy numbering) 3.2 · Chapter 6 of 20
Host access, privilege escalation and persistence concepts
About 6 minutes · EC-Council knowledge-exam blueprint v5.0; practical examination and training-version labels are separate
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Initial access is not the same as elevated privilege.
Explore the anchors
Establish a permitted test foothold.
Concept matching activity
Match this task or description to its concept:
Examine the permission boundary.
Choose a concept before checking the explanation.
Access-decision sandbox
Try to edit a fictional record as a reader. Then change one condition and evaluate again. This simplified policy requires authentication, object scope and action permission; real policies have more conditions.
Change the request, then evaluate it.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Concepts and mechanisms
- Assessment, defenses and evidence
- Host privilege and accountability — deeper assessment study
Concepts and mechanisms
Initial access, privilege escalation and persistence are different capabilities. Initial access establishes a foothold; escalation increases authority; persistence preserves a route to return. A user-level process does not automatically have administrator rights, and a restarted host is not necessarily free of an external stolen credential.
Common contributing weaknesses include excessive account permissions, exposed credentials, unsafe configuration, vulnerable components and poorly controlled service identities. An assessment evaluates the effective permission path, not only the account’s label. Credential reuse can connect systems that appear separately secured.
Assessment, defenses and evidence
Use approved accounts and controlled demonstrations. Do not collect unrelated credentials, alter production logs or install uncontrolled persistence to make a finding convincing. If the engagement includes a controlled persistence simulation, define removal, monitoring and verification in advance. Evidence should be minimal and attributable.
Defenses combine least privilege, supported software, hardened configuration, credential protection, monitored administration and application controls. Recovery needs removal of the cause and surviving access paths, not just one file. Revoke affected sessions or secrets where required and verify that both normal service and expected denials work.
Host privilege and accountability — deeper assessment study
Initial access, privilege escalation and persistence are distinct changes in capability. Local administrator, directory administrator and cloud service permissions also have different scopes. Service-account secrets, overbroad delegation and writable privileged components can create paths across those boundaries. A successful login does not establish authorization for privileged actions or other accounts.
Assess the controls and evidence around these paths in an isolated authorized environment. Detect suspicious service creation, privileged-group changes and unexpected remote administration. Preserve and correlate logs: deleting evidence is not an academy exercise. Verify cleanup and revoke test access after work. AI-proposed actions need the same authorization and validation as manual actions; automation does not reduce accountability.
Worked example
An unauthorized scheduled task runs with a service identity. The investigation checks task creation, executable integrity, account rights and change records before attributing it to an attacker.
Check your understanding
Why can rebuilding a host fail to stop recurrence?
Show explanation
Stolen credentials, external sessions, management trust or an uncorrected deployment process can survive the rebuild and recreate access.
Apply this course’s topics in the CEH evidence workbench →
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.