> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/enumerating-protections.md).

# Enumerating Protections

### Windows Updates

{% code title="WMI to query missing KBs" %}

```bat
C:\htb> wmic qfe

Caption                                     CSName      Description  FixComments  HotFixID   InstallDate  InstalledBy               InstalledOn  Name  ServicePackInEffect  Status
http://support.microsoft.com/?kbid=2533552  WINLPE-2K8  Update                    KB2533552               WINLPE-2K8\Administrator  3/31/202batch
```

{% endcode %}

You can also use [Sherlock](https://github.com/rasta-mouse/Sherlock) to assess the patches...

{% code title="" %}

```powershell
PS C:\htb> Set-ExecutionPolicy bypass -Scope process
PS C:\htb> Import-Module .\Sherlock.ps1
PS C:\htb> Find-AllVulns

Title      : User Mode to Ring (KiTrap0D)
MSBulletin : MS10-015
CVEID      : 2010-0232
Link       : https://www.exploit-db.com/exploits/11199/
VulnStatus : Not supported on 64-bit systems

Title      : Task Scheduler .XML
MSBulletin : MS10-092
CVEID      : 2010-3338, 2010-3888
Link       : https://www.exploit-db.com/exploits/19930/
VulnStatus : Appears Vulnerable
<SNIP>
```

{% endcode %}

### Commonly Used Defenders

#### AppLocker

A popular solution for whitelisting apps from Microsoft ([AppLocker](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview))

[GetAppLockerPolicy ](https://docs.microsoft.com/en-us/powershell/module/applocker/get-applockerpolicy?view=windowsserver2019-ps)cmdlet can enumerate local, effecative (enforced), and domain AppLocker policies. This will list potential blocked binaries or file types that we can try to bypass.

{% code title="List AppLocker Rules" %}

```powershell
Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections
```

{% endcode %}

{% code title="Test AppLocker Policy" overflow="wrap" %}

```powershell
Get-AppLockerPolicy -Local | Test-AppLockerPolicy -path C:\Windows\System32\cmd.exe -User Everyone
```

{% endcode %}

#### Windows Defender

{% code title="Check Status of Windows Defender" %}

```powershell
Get-MpComputerStatus
```

{% endcode %}

## **Detection**

### Windows Event Forwarding (WEF)

Allows you to forward audit logs in a central location. You may enable the auditing of both sensitive and non-sensitive privilege usage via GPO. It's also valuable to audit special privileges assigned to new logons, however, it's recommended to disable auditing of backup and restore privileges as these can often become quite noisy.

[Authorization Policy Change](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-authorization-policy-change) auditing can send notifications when token privileges are enabled or disabled.

* [Setting up WEF](https://medium.com/palantir/windows-event-forwarding-for-network-defense-cb208d5ff86f)
* [GitHub Repository of configuration and management details](https://github.com/palantir/windows-event-forwarding)

## Mitigations

### Removing Privileges

1. Create a security group in AD for exemptions
2. Add users to the group
3. Create a GPO and configure it to only assign the privileges for "Debug Programs" to users in the SeDebug-Exceptions-sg group. This may be configured at `Computer\Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment`

Note however that not all privileges (`SeBackupPrivilege`, `SeImpersonatePrivilege`) may be removed. Additionally, modifying privileges does not restrict system-level accounts (e.g. SYSTEM) as these are required for the OS to function.

| Event                                                                                                                                                                            | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [4672](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4672): Special privileges assigned to a new logon | <p>Logged if the following privileges are assigned to a new logon session:</p><p><br><code>SeTcbPrivilege</code>, <code>SeBackupPrivilege</code>, <code>SeCreateTokenPrivilege</code>, <code>SeDebugPrivilege</code>, <code>SeEnableDelegationPrivilege</code>, <code>SeAuditPrivilege</code>, <code>SeImpersonatePrivilege</code>, <code>SeLoadDriverPrivilege</code>, <code>SeSecurityPrivilege</code>, <code>SeSystemEnvironmentPrivilege</code>, <code>SeAssignPrimaryTokenPrivilege</code>, <code>SeRestorePrivilege</code>, <code>SeTakeOwnershipPrivilege</code></p> |
|                                                                                                                                                                                  |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
|                                                                                                                                                                                  |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |