Use when: Windows foothold — systematic enumeration of system info, users, groups, processes, services, and installed software to identify privesc paths.
Think Dumber First:whoami /all → systeminfo → net localgroup administrators → tasklist /svc. These four commands give: current privileges, OS version (for CVEs), local admin group membership, and all running services with their service accounts. Run them all immediately.
Skip when: Already SYSTEM/Administrator — skip enumeration and go directly to post-exploitation objectives.
# Get exact build[System.Environment]::OSVersion.Version# → Major.Minor.Build.Revision# Or from systeminfo:systeminfo | findstr /B /C:"OS Version" /C:"OS Name"
Token Privilege Targets
Privilege
Attack Path
SeImpersonatePrivilege
JuicyPotato (≤1809) or PrintSpoofer (≥1809)
SeAssignPrimaryTokenPrivilege
Same as SeImpersonate — Potato attacks
SeDebugPrivilege
Dump LSASS → Mimikatz → credentials
SeTakeOwnershipPrivilege
takeown + icacls → read/overwrite any file
SeBackupPrivilege
Read any file including NTDS.dit
SeRestorePrivilege
Write any file — overwrite system binaries
SeLoadDriverPrivilege
Load malicious kernel driver
SeCreateSymbolicLinkPrivilege
Symlink attacks on privileged file ops
AV/EDR Detection
# Check Windows Defender statusGet-MpComputerStatus | Select RealTimeProtectionEnabled, AntivirusEnabled# List all security products (WMI)Get-WmiObject -Class AntiVirusProduct -Namespace root\SecurityCenter2# Common AV process names to look for in tasklist:# MsMpEng.exe (Defender), cb.exe (CarbonBlack), bdagent.exe (BitDefender)# ekrn.exe (ESET), avgnt.exe (Avira), SEPMaster.exe (Symantec)# Check AppLockerGet-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections# If blocked: use LOLBAS (Living Off the Land Binaries)
Network Enumeration
# Listening services → tunnel candidatesnetstat -ano | findstr LISTEN# Established connections → active sessionsnetstat -ano | findstr ESTABLISHED# Match PID to processtasklist | findstr [PID]# DNS servers (may be DC)ipconfig /all | findstr "DNS Server"# Sharesnet share
Installed Software Hunt
# 64-bit appsGet-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\* | Select DisplayName, DisplayVersion, InstallDate | Sort-Object DisplayName# 32-bit apps on 64-bit OSGet-ItemProperty HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select DisplayName, DisplayVersion | Sort-Object DisplayName# Or via wmicwmic product get name,version,vendor
🛠️ Troubleshooting & Edge Cases
Problem
Cause
Fix
systeminfo blocked
Restricted shell or policy
Try: wmic computersystem get caption,model,systemtype, wmic os get version,caption,buildnumber
Use WMI: wmic group list brief, wmic localgroup list brief
Process list shows unknown services
Possibly interesting custom service
Check: sc qc [SERVICE_NAME] for binary path; icacls [BINARY_PATH] for write permission
Installed software enumeration incomplete
32-bit vs 64-bit registry
Check both: HKLM\SOFTWARE\ and HKLM\SOFTWARE\WOW6432Node\
📝 Reporting Trigger
Finding Title: Windows System Enumeration Reveals Privilege Escalation Paths
Impact: Systematic Windows enumeration identifies unquoted service paths, weak service binary permissions, AlwaysInstallElevated policy, and other misconfigurations that enable privilege escalation from low-privileged user to SYSTEM.
Root Cause: Windows system not hardened against common privilege escalation vectors. Default Windows configurations not reviewed or remediated post-deployment.
Recommendation: Run PowerUp.ps1 and WinPEAS against all Windows systems during hardening review. Apply Windows security baselines. Implement automated misconfiguration detection in vulnerability scanning program.