MITRE ATT&CK T1068 is the technique for exploitation for privilege escalation: using a software flaw to gain higher system rights than the attacker already has. That may mean moving from a standard user to administrator or from a limited service context into a more trusted process.
This matters because privilege escalation often turns a small foothold into full system control. In real attacks, T1068 can involve local kernel bugs, insecure drivers, vulnerable services, or flaws in security products themselves. Defenders look for patchable weaknesses, privilege boundaries that can be abused, and signs such as unusual child processes, protected file changes, or security-agent tampering. Mapping activity to T1068 helps analysts describe how an attacker crossed a trust boundary and what control failed.