Privileges 101

• Privileges in Windows are rights that an account can be granted to perform a variety of operations on the local system such as managing services, loading drivers, shutting down the system, debugging an application, and more
• 
• 

Rights and Privileges in Windows

• 

User Rights Assignment

• https://4sysops.com/archives/user-rights-assignment-in-windows-server-2016/
• https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/user-rights-assignment
• eg: SeBackupPrivilege, SeImpersonatePrivilege
• whoami /priv
• some rights are only available to administrative users and can only be listed/leveraged when running an elevated cmd or PowerShell session.

Enable Privileges

• our account could have privileges that are disabled
• we cant just enable them
• the following scripts will help us enable the wanted privileges
  • https://www.powershellgallery.com/packages/PoshPrivilege/0.3.0.0/Content/Scripts%5CEnable-Privilege.ps1
  • https://www.leeholmes.com/adjusting-token-privileges-in-powershell/

DETECTION

• https://blog.palantir.com/windows-privilege-abuse-auditing-detection-and-defense-3078a403d74e