Overview
The TokenPrivileges command enumerates the privileges assigned to the current process token, showing which are enabled, disabled, or removed. Windows privileges control what actions a process can perform, and certain privileges (like SeDebugPrivilege, SeImpersonatePrivilege) are critical for offensive operations and privilege escalation.Syntax
This command does not support remote execution.
Output
Returns token privilege information:- Privilege name
- Status (Enabled, Disabled, Enabled by Default)
- Description
- Privilege LUID
Use Cases
- Red Team
- Blue Team
- Identify available privileges for exploitation
- Check for SeDebugPrivilege (credential dumping)
- Verify SeImpersonatePrivilege (token impersonation)
- Assess SeBackupPrivilege (file access)
- Plan privilege escalation techniques
Example Output
Remote Execution
Detection Considerations
Minimal detection risk - queries current process token.
- API Calls: Uses GetTokenInformation with TokenPrivileges class
- No Privilege Changes: Only reads existing privileges
- EDR Telemetry: May be logged as process behavior
High-Value Privileges for Attackers
Dangerous Privileges
Dangerous Privileges
SeDebugPrivilege
- Allows debugging and accessing other processes
- Used for credential dumping (LSASS access)
- Enables token impersonation attacks
- Key for potato-style privilege escalation
- Allows reading any file on the system
- Can be used to access SAM/SYSTEM/SECURITY hives
- Allows writing to any file
- Can modify system files and registry
- Allows loading kernel drivers
- Can be used for kernel-level persistence
- Allows taking ownership of objects
- Can bypass file/registry permissions
Related Commands
- TokenGroups - Current token group membership
- LogonSessions - Active logon sessions
- LocalGroups - Local group membership
- UserRightAssignments - User rights configuration