What is privilege escalation?
Privilege escalation is the attacker turning limited access into more power: from an ordinary user to local administrator, and from there to domain or cloud administrator. They exploit unpatched vulnerabilities, misconfigured services, passwords stored in scripts or browsers, and accounts that have more rights than their job needs. It happens mostly inside hosts and the directory, so prevention is patching, removing local administrator rights from everyday accounts, separate administrator accounts used only for administration, and regular reviews of who belongs to privileged groups. A network sensor sees little of the escalation itself. It sees what the attacker does with the new rights, which typically involves the network: sessions to the domain controller, administrative connections to many servers, access to backups. NetSenX flags that lateral movement on every plan, Free included.