Publication

Abstract : Privilege escalation is perhaps the most elusive and dangerous attack vector on Windows operating systems. This project describes an integrated solution that simulates a privilege escalation attack and incorporates a two-pronged prevention mechanism: a light-weight C\#-based system-level service named PrivilegeBlocker and an external Machine Learning (ML) detection model trained to detect anomalies typical of privilege escalation attempts. The simulation demonstrates how C++ exploits can mimic real escalation behavior. The prevention mechanism catches access control violations and notifies users whereas the ML model maximizes long-term threat detection. This paper outlines the design, implementation, simulation, and analysis of this scheme, which achieves maximum endpoint protection on Windows systems. The system can be executed continuously as a background service, providing advanced security without disrupting user activities or degrading performance.