Privileges

Windows privilege mechanics — what privileges mean, the most abused privileges in post-exploitation, how to enable them programmatically, and detection via Event ID 4672

What Is a Privilege

A privilege is a system-level right assigned to an account that allows it to perform an operation that goes beyond normal access control. Unlike permissions (which are attached to objects), privileges are attached to subjects (tokens). Common examples: the right to debug other processes, the right to load kernel drivers, the right to back up files ignoring DACL.

Each privilege has:

• A name (e.g., SeDebugPrivilege) — used in policy settings and APIs
• A LUID — a locally unique identifier assigned at boot, used internally
• An attribute — SE_PRIVILEGE_ENABLED (active), SE_PRIVILEGE_ENABLED_BY_DEFAULT, or disabled (present but inactive)

Key Offensive Privileges

Enabling Privileges Programmatically

// Enable a privilege in the current process token
BOOL EnablePrivilege(const char *privName, BOOL enable)
{
    HANDLE hToken;
    if (!OpenProcessToken(GetCurrentProcess(),
                           TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
        return FALSE;

    LUID luid;
    if (!LookupPrivilegeValueA(NULL, privName, &luid)) {
        CloseHandle(hToken);
        return FALSE;
    }

    TOKEN_PRIVILEGES tp = {};
    tp.PrivilegeCount           = 1;
    tp.Privileges[0].Luid       = luid;
    tp.Privileges[0].Attributes = enable ? SE_PRIVILEGE_ENABLED : 0;

    BOOL ok = AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(tp), NULL, NULL);
    DWORD err = GetLastError();
    CloseHandle(hToken);

    // AdjustTokenPrivileges returns TRUE even on partial success;
    // ERROR_NOT_ALL_ASSIGNED means the privilege wasn't in the token at all
    return ok && err != ERROR_NOT_ALL_ASSIGNED;
}

// Usage:
EnablePrivilege(SE_DEBUG_NAME, TRUE);   // "SeDebugPrivilege"
// Now OpenProcess(PROCESS_ALL_ACCESS, ...) will succeed on SYSTEM processes

Privilege Abuse Chains

The most common post-exploitation privilege chains in detection engineering:

Detection

# Key event IDs for privilege monitoring

# 4672: Special privileges assigned to new logon
#   Fires when: any of the following privileges are in a new logon token:
#     SeAssignPrimaryTokenPrivilege, SeAuditPrivilege, SeBackupPrivilege,
#     SeCreateTokenPrivilege, SeDebugPrivilege, SeImpersonatePrivilege,
#     SeLoadDriverPrivilege, SeSecurityPrivilege, SeTakeOwnershipPrivilege,
#     SeTcbPrivilege, and more
#   Look for: these on unexpected accounts (not on service accounts that
#     should have SeImpersonatePrivilege — those are noise; focus on
#     SeDebugPrivilege on non-admin accounts, or SeTcbPrivilege anywhere)

# 4673: A privileged service was called
#   Fires when a privilege is used, not just present

# 4674: An operation was attempted on a privileged object
#   Fires when a privilege check was performed

# Sigma: detect SeDebugPrivilege enabled on non-admin process
title: SeDebugPrivilege Enabled on Non-Admin Process
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4673
        PrivilegeName: 'SeDebugPrivilege'
    filter_admin:
        SubjectUserSid|endswith:
            - '-500'  # Built-in admin RID
    condition: selection and not filter_admin
fields:
    - SubjectUserName
    - SubjectUserSid
    - ProcessName

Q & A