T1404: Exploit OS Vulnerability
An adversary technique where an unpatched operating-system vulnerability is used to escalate privileges beyond what the app or attacker should have.
Why It Matters
This technique represents the escalation step an attacker takes after establishing initial access — understanding it clarifies why a credential leak (M1) or an authentication bypass (M3) can lead to more than just data exposure at the app level.
Application to Application Security
Relevant to application security because an app-level weakness (a leaked credential granting a foothold, a broken authentication check) is often the precondition that makes OS-level privilege escalation worthwhile to attempt next.
Relation to Software Development
Engineering teams don't fix OS vulnerabilities directly, but they control how much an app-level compromise is worth escalating — minimizing what a compromised app can access limits the payoff of a successful escalation.
How Strata Surfaces This
Strata doesn't detect OS-level exploitation directly; it maps this technique to the app-level weaknesses (M1 credential exposure, M3 authentication bypass) that commonly precede an escalation attempt in an attack chain.
Developer guidance
Minimize what a compromised app instance can reach — scope tokens narrowly, avoid granting broad device permissions the app doesn't need — so a successful app-level compromise has a smaller escalation payoff.
Management guidance
Threat-model in terms of attack chains, not isolated findings — an M1 finding's real risk includes what it enables next, not just its own severity score.