itm4n-PrivescCheck/data/Checks.csv

1	Id	Command	Category	DisplayName	Severity	Format	Type	RunIfAdmin	Risky	Description
2	USER_USER	Invoke-UserCheck	TA0043 - Reconnaissance	User - Identity	None	List	Base	True	False	Get information about the current user (name, domain name) and its access token (SID, integrity level, authentication ID).
3	USER_GROUPS	Invoke-UserGroupCheck	TA0043 - Reconnaissance	User - Groups	None	Table	Base	True	False	Get information about the groups the current user belongs to (name, type, SID).
4	USER_RESTRICTED_SIDS	Invoke-UserRestrictedSidCheck	TA0043 - Reconnaissance	User - Restricted SIDs	None	Table	Extended	True	False	Get information about potential restricted SIDs applied to the current user.
5	USER_PRIVILEGES	Invoke-UserPrivilegeCheck	TA0004 - Privilege Escalation	User - Privileges	High	Table	Base	False	False	Check whether the current user is granted privileges that can be leveraged for local privilege escalation.
6	USER_PRIVILEGES_GPO	Invoke-UserPrivilegeGpoCheck	TA0004 - Privilege Escalation	User - Privileges (GPO)	High	List	Base	False	False	Check whether the current user is granted privileges, through a group policy, that can be leveraged for local privilege escalation.
7	USER_ENV	Invoke-UserEnvironmentCheck	TA0006 - Credential Access	User - Environment Variables	None	Table	Base	True	False	Check whether any environment variables contain sensitive information such as credentials or secrets. Note that this check follows a keyword-based approach and thus might not be completely reliable.
8	SERVICE_INSTALLED	Invoke-InstalledServiceCheck	TA0004 - Privilege Escalation	Services - Non-Default Services	None	List	Base	True	False	Get information about third-party services. It does so by parsing the target executable's metadata and checking whether the publisher is Microsoft.
9	SERVICE_THIRD_PARTY	Invoke-ThirdPartyDriverCheck	TA0004 - Privilege Escalation	Services - Non-Default Kernel Drivers	None	List	Extended	True	False	Get information about third-party kernel drivers. It does so by parsing the driver's metadata and checking whether the publisher is Microsoft.
10	SERVICE_VULN_DRIVER	Invoke-VulnerableDriverCheck	TA0004 - Privilege Escalation	Services - Known Vulnerable Kernel Drivers	High	List	Base	True	False	Check whether known vulnerable kernel drivers are installed. It does so by computing the file hash of each driver and comparing the value against the list provided by loldrivers.io.
11	SERVICE_KERNEL_DEVICES	Invoke-NamedKernelDeviceCheck	TA0004 - Privilege Escalation	Services - Named Kernel Device Permissions	None	List	Extended	False	False	Get information about named Kernel devices for which low-privileged users are granted write access. This can be helpful as a first step to identify exploitable drivers.
12	SERVICE_PERMISSIONS	Invoke-ServicePermissionCheck	TA0004 - Privilege Escalation	Services - Permissions	High	List	Base	False	False	Check whether the current user has any write permissions on a service through the Service Control Manager (SCM).
13	SERVICE_PERMISSIONS_REGISTRY	Invoke-ServiceRegistryPermissionCheck	TA0004 - Privilege Escalation	Services - Registry Permissions	High	List	Base	False	False	Check whether the current user has any write permissions on the configuration of a service in the registry.
14	SERVICE_IMAGE_PERMISSIONS	Invoke-ServiceImagePermissionCheck	TA0004 - Privilege Escalation	Services - Image File Permissions	High	List	Base	False	False	Check whether the current user has any write permissions on a service's binary or its folder.
15	SERVICE_UNQUOTED_PATH	Invoke-ServiceUnquotedPathCheck	TA0004 - Privilege Escalation	Services - Unquoted Paths	High	List	Base	False	False	Check whether there are services configured with an exploitable unquoted path that contains spaces.
16	SERVICE_SCM_PERMISSIONS	Invoke-ServiceControlManagerPermissionCheck	TA0004 - Privilege Escalation	Services - Service Control Manager Permissions	High	List	Base	False	False	Check whether the current user has any write permissions on the Service Control Manager (SCM).
17	SERVICE_HARDCODED_CREDS	Invoke-ServiceCredentialCheck	TA0006 - Credential Access	Services - Hardcoded Credentials	Low	List	Extended	True	False	Check whether there are services configured with hardcoded credentials, in which case the service account's password is likely to be stored in a reversible format in the registry, and can be extracted with administrator privileges.
18	APP_INSTALLED	Invoke-InstalledApplicationCheck	TA0043 - Reconnaissance	Applications - Microsoft	None	Table	Extended	True	False	Get information about Microsoft applications installed on the machine by searching the registry and the default install locations.
19	APP_INSTALLED_THIRD_PARTY	Invoke-InstalledApplicationThirdPartyCheck	TA0043 - Reconnaissance	Applications - Third-Party	None	Table	Extended	True	False	Get information about third-party applications installed on the machine by searching the registry and the default install locations.
20	APP_MODIFIABLE	Invoke-InstalledApplicationPermissionCheck	TA0004 - Privilege Escalation	Applications - File Permissions	Medium	List	Extended	False	False	Check whether the current user has any write permissions on non-default or third-party applications.
21	APP_PROGRAMDATA	Invoke-ProgramDataPermissionCheck	TA0004 - Privilege Escalation	Applications - ProgramData Folder Permissions	Low	List	Experimental	False	False	Check whether the current user has any write permissions on a non-default 'ProgramData' folder. This check is purely informative and the results require manual analysis.
22	APP_ROOT_FOLDER_PERMISSIONS	Invoke-RootFolderPermissionCheck	TA0004 - Privilege Escalation	Applications - Root Folder Permissions	Low	List	Extended	False	False	Check whether the current user has any modification right on or within a folder located at the root of a 'fixed' drive.
23	APP_STARTUP	Invoke-StartupApplicationPermissionCheck	TA0004 - Privilege Escalation	Applications - Startup Application Permissions	Medium	List	Extended	False	False	Check whether the current user has any write permissions on system-wide applications that are run at startup for all users.
24	APP_PROCESSES	Invoke-RunningProcessCheck	TA0043 - Reconnaissance	Applications - Running Processes	None	Table	Extended	True	False	Get information about the currently running processes that are not owned by the current user. Processes such as 'svchost.exe' are filtered out.
25	SCHTASKS_IMAGE_PERMISSIONS	Invoke-ScheduledTaskImagePermissionCheck	TA0004 - Privilege Escalation	Scheduled Tasks - Image File Permissions	High	List	Base	False	False	Check whether the current user has any write permissions on a scheduled task's binary or its folder. Note that low-privileged users cannot list all the scheduled tasks.
26	SCHTASKS_UNQUOTED_PATH	Invoke-ScheduledTaskUnquotedPathCheck	TA0004 - Privilege Escalation	Scheduled Tasks - Unquoted Paths	Medium	List	Experimental	False	False	Check whether there are scheduled tasks configured with an exploitable unquoted path. Note that low-privileged users cannot list all the scheduled tasks.
27	SCHTASKS_HARDCODED_CREDS	Invoke-ScheduledTaskCredentialCheck	TA0006 - Credential Access	Scheduled Tasks - Hardcoded Credentials	Low	List	Extended	True	False	Check whether there are scheduled tasks configured with hardcoded credentials (logon type 'Password'), in which case the user account's password is stored in a reversible format in the registry, and can be extracted with administrator privileges.
28	CREDS_SENSITIVE_HIVE_FILES	Invoke-HiveFilePermissionCheck	TA0006 - Credential Access	Credentials - Hive File Permissions	Medium	List	Base	False	False	Check whether the current user has read permissions on the SAM/SYSTEM/SECURITY hive files, either in the system folder or in volume shadow copies (CVE-2021-36934 - HiveNightmare).
29	CREDS_UNATTEND	Invoke-UnattendFileCredentialCheck	TA0006 - Credential Access	Credentials - Unattend Files	Medium	List	Base	True	False	Check whether there are any 'unattend' files and whether they contain clear-text credentials.
30	CREDS_WINLOGON	Invoke-WinLogonCredentialCheck	TA0006 - Credential Access	Credentials - WinLogon	Medium	List	Base	True	False	Check whether the 'WinLogon' registry key contains clear-text credentials. Note that entries with an empty password field are filtered out.
31	CREDS_CRED_MASTER_KEYS	Invoke-CredentialMasterKeyCheck	TA0006 - Credential Access	Credentials - DPAPI Master Keys	None	List	Extended	True	False	Get information about the current user's DPAPI master keys.
32	CREDS_CRED_FILES	Invoke-CredentialFileCheck	TA0006 - Credential Access	Credentials - DPAPI Credential Files	None	List	Extended	True	False	Get information about the current user's DPAPI credential files.
33	CREDS_VAULT_CRED	Invoke-CredentialCheck	TA0006 - Credential Access	Credentials - Vault (creds)	None	List	Base	True	True	Check whether the current user's credential vault contains any clear-text Windows passwords.
34	CREDS_VAULT_LIST	Invoke-VaultCheck	TA0006 - Credential Access	Credentials - Vault (list)	None	List	Base	True	True	Check whether the current user's credential vault contains any clear-text web passwords.
35	CREDS_GPP	Invoke-GPPCredentialCheck	TA0006 - Credential Access	Credentials - Group Policy Preferences (GPP)	Medium	List	Base	True	False	Check whether there are cached Group Policy Preference (GPP) files that contain clear-text passwords.
36	CREDS_PS_HIST	Invoke-PowerShellHistoryCredentialCheck	TA0006 - Credential Access	Credentials - PowerShell History	None	List	Extended	True	False	Check whether the current user's PowerShell history contains any clear-text credentials. Note that this check follows a keyword-based approach and thus might not be completely reliable.
37	CREDS_SCCM_NAA	Invoke-SccmNaaCredentialCheck	TA0006 - Credential Access	Credentials - SCCM Network Access Account (NAA)	Medium	List	Base	True	False	Check whether SCCM NAA credentials are stored in the WMI repository. If so, the username and password DPAPI blobs are returned, but can only be decrypted using the SYSTEM's DPAPI user key.
38	CREDS_SCCM_CACHE_FOLDERS	Invoke-SccmCacheFolderCredentialCheck	TA0006 - Credential Access	Credentials - SCCM Cache Folder	Low	List	Base	True	False	Check whether the SCCM cache folders contain files with potentially hard coded credentials, or secrets, using basic keywords such as 'password', or 'secret'.
39	CREDS_SMA_ACC	Invoke-SmaAgentConnectivityCredentialCheck	TA0006 - Credential Access	Credentials - Symantec Account Connectivity	Medium	List	Base	True	False	Check whether a Symantec Management Agent (SMA) is installed and whether Account Connectivity Credentials (ACCs) are stored locally.
40	CREDS_SCOM_RUN_AS	Invoke-ScomRunAsAccountCredentialCheck	TA0006 - Credential Access	Credentials - SCOM Run As Account	Medium	List	Base	True	False	Check whether the event logs contain traces of SCOM Run As accounts being used locally. If so, the clear-text credentials of those accounts can be extracted from the registry with administrator privileges.
41	CREDS_VNC	Invoke-VncCredentialCheck	TA0006 - Credential Access	Credentials - VNC Server Password	Medium	List	Extended	True	False	Check whether a well-known VNC server (RealVNC, TigerVNC, TightVNC, UltraVNC) is installed. If so, it attempts to read and decrypt the encrypted password. Note that this might require administrator privileges.
42	CREDS_CERTIFICATES	Invoke-PersonalCertificateCheck	TA0006 - Credential Access	Credentials - Personal Certificates	None	List	Extended	True	False	Get information about machine and user personal certificates. Those certificates can be found in the registry and on the filesystem in each user's home folder.
43	HARDEN_UAC	Invoke-UserAccountControlCheck	TA0008 - Lateral Movement	Hardening - User Account Control (UAC)	Low	List	Audit	True	False	Check whether User Access Control (UAC) is enabled and whether it filters the access token of local administrator accounts when they authenticate remotely.
44	HARDEN_NAME_RESOLUTION	Invoke-NameResolutionProtocolCheck	TA0006 - Credential Access	Hardening - Name Resolution Protocols	Low	List	Audit	True	False	Check whether broadcast and multicast name resolution protocols are disabled.
45	HARDEN_IPV6	Invoke-Ipv6ConfigurationCheck	TA0006 - Credential Access	Hardening - IPv6 Configuration	Low	List	Audit	True	False	Check whether IPv6 is disabled globally. Disabling IPv6 aims at limiting the risk of credential stealing by preventing DHCPv6 poisoning attacks.
46	HARDEN_LSA_PROTECTION	Invoke-LsaProtectionCheck	TA0006 - Credential Access	Hardening - LSA Protection	Low	List	Base	True	False	Check whether LSA protection is enabled. Note that when LSA protection is enabled, 'lsass.exe' runs as a Protected Process Light (PPL) and thus can only be accessed by other protected processes with an equivalent or higher protection level.
47	HARDEN_CREDENTIAL_GUARD	Invoke-CredentialGuardCheck	TA0006 - Credential Access	Hardening - Credential Guard	Low	List	Base	True	False	Check whether Credential Guard is supported and enabled. Note that when Credential Guard is enabled, credentials are stored in an isolated process ('LsaIso.exe') that cannot be accessed, even if the kernel is compromised.
48	HARDEN_ASR_RULES	Invoke-AttackSurfaceReductionRuleCheck	TA0005 - Defense Evasion	Hardening - Attack Surface Reduction (ASR)	None	List	Extended	True	False	Get information about configured Windows Defender Exploit Guard Attack Surface Reduction (ASR) rules.
49	HARDEN_BIOS_MODE	Invoke-BiosModeCheck	TA0003 - Persistence	Hardening - UEFI & Secure Boot	Low	Table	Extended	True	False	Check whether UEFI and Secure Boot are supported and enabled. Note that Secure Boot requires UEFI.
50	HARDEN_LAPS	Invoke-LapsCheck	TA0008 - Lateral Movement	Hardening - LAPS	Medium	List	Base	True	False	Check whether LAPS is configured and enabled. Note that this applies to domain-joined machines only.
51	HARDEN_PS_SECURITY_FEATURES	Invoke-PowerShellSecurityFeatureCheck	TA0002 - Execution	Hardening - PowerShell Security Features	Low	List	Audit	True	False	Check whether PowerShell security features are configured and enabled.
52	MISC_TPM_DEVICE_INFO	Invoke-TpmDeviceInformationCheck	TA0043 - Reconnaissance	Misc - TPM Device Information	None	List	Extended	True	False	Get information about the machine's Trusted Platform Module (TPM), if present.
53	HARDEN_BITLOCKER	Invoke-BitLockerCheck	TA0001 - Initial Access	Hardening - BitLocker	Medium	List	Base	True	False	Check whether BitLocker is enabled on the system drive and requires a second factor of authentication (PIN or startup key). Note that this check might yield a false positive if a third-party drive encryption software is installed.
54	HARDEN_APPLOCKER	Invoke-AppLockerCheck	TA0005 - Defense Evasion	Hardening - AppLocker	Low	List	Audit	True	False	Check whether an AppLocker policy is enforced.
55	HARDEN_APPLOCKER_POLICY	Invoke-AppLockerPolicyCheck	TA0005 - Defense Evasion	Hardening - AppLocker Policy	Low	List	Extended	False	False	Check whether AppLocker rules can be exploited, in the context of the current user, to execute arbitrary code.
56	HARDEN_FILE_EXTENSION_ASSOC	Invoke-FileExtensionAssociationCheck	TA0001 - Initial Access	Hardening - File Extension Associations	Low	Table	Audit	True	False	Check whether file extensions such as '.bat' or '.wsh' are associated to a text editor. Note that only basic text editors such as 'Notepad' are detected. If a rich text editor is set instead, this check could yield false positives.
57	HARDEN_HIDDEN_FILE_EXTENSIONS	Invoke-HiddenFilenameExtensionCheck	TA0001 - Initial Access	Hardening - Hidden File Name Extensions	Low	List	Audit	True	False	Check whether extensions of known file types are shown or hidden in the Explorer.
58	HARDEN_DEFAULT_LOCAL_ADMIN	Invoke-DefaultLocalAdministratorAccountCheck	TA0008 - Lateral Movement	Hardening - Default Local Administrator Account	Low	List	Audit	True	False	Check whether the default local administrator account is disabled.
59	HARDEN_CLICKONCE_PROMPT	Invoke-ClickOnceTrustPromptBehaviorCheck	TA0001 - Initial Access	Hardening - ClickOnce Trust Prompt Behavior	Low	List	Audit	True	False	Check whether users are allowed to execute ClickOnce applications from the 'Internet' zone.
60	HARDEN_OFFICE_MACROS	Invoke-OfficeMacroConfigurationCheck	TA0001 - Initial Access	Hardening - MS Office Macro Settings	Low	List	Audit	True	False	Check whether Office macros are enabled or disabled with a notification.
61	HARDEN_OFFICE_PROTECTED_VIEW	Invoke-OfficeProtectedViewConfigurationCheck	TA0001 - Initial Access	Hardening - MS Office Protected View Settings	Low	List	Audit	True	False	Check whether Office Protected View is enabled on all supported applications.
62	HARDEN_OFFICE_TRUSTED_LOCATIONS	Invoke-OfficeTrustedLocationsCheck	TA0001 - Initial Access	Hardening - MS Office Trusted Locations	Low	List	Audit	True	False	Check whether Office Trusted Locations are enabled and whether they contain any directory modifiable as the current user.
63	CONFIG_PATH_FOLDERS	Invoke-DllHijackingCheck	TA0004 - Privilege Escalation	Configuration - PATH Folder Permissions	High	List	Base	False	False	Check whether the current user has any write permissions on the system-wide PATH folders. If so, the system could be vulnerable to privilege escalation through ghost DLL hijacking.
64	MISC_HIJACKABLE_DLL	Invoke-HijackableDllCheck	TA0004 - Privilege Escalation	Misc - Known Ghost DLLs	None	List	Base	False	False	Get information about services that are known to be prone to ghost DLL hijacking. Note that their exploitation requires the current user to have write permissions on at least one system-wide PATH folder.
65	CONFIG_CREDENTIAL_DELEGATION	Invoke-CredentialDelegationCheck	TA0006 - Credential Access	Configuration - Credential Delegation	Medium	List	Extended	True	False	Check whether Credential Delegation is enabled. If so, passwords are very likely to be stored in clear-text in memory, unless another setting prevents that. Note that LSA Protection is not sufficient to protect credentials in this case.
66	CONFIG_NTLM_DOWNGRADE	Invoke-NtlmDowngradeAttackCheck	TA0004 - Privilege Escalation	Configuration - NTLM Downgrade (NTLMv1)	High	List	Base	True	False	Check whether the machine is vulnerable to NTLM downgrade attacks. If so, a local or remote attacker could capture the NTLMv1 authentication of the computer account (or another authenticated user), and recover its NT hash offline.
67	CONFIG_MSI	Invoke-RegistryAlwaysInstallElevatedCheck	TA0004 - Privilege Escalation	Configuration - MSI AlwaysInstallElevated	High	List	Base	False	False	Check whether the 'AlwaysInstallElevated' policy is enabled system-wide and for the current user. If so, the current user may install a Windows Installer package with elevated (SYSTEM) privileges.
68	CONFIG_WSUS	Invoke-WsusConfigurationCheck	TA0008 - Lateral Movement	Configuration - WSUS	High	List	Base	True	False	Check whether WSUS uses the HTTPS protocol to retrieve updates from the on-premise update server. If WSUS uses the clear-text HTTP protocol, it is vulnerable to MitM attacks that may result in remote code execution as SYSTEM.
69	CONFIG_HARDENED_UNC_PATHS	Invoke-HardenedUNCPathCheck	TA0008 - Lateral Movement	Configuration - Hardened UNC Paths	Medium	List	Base	True	False	Check whether sensitive UNC paths are properly hardened. Note that non-hardened UNC paths used for retrieving group policies can be hijacked through an MitM attack to obtain remote code execution as SYSTEM.
70	CONFIG_SMB	Invoke-SmbConfigurationCheck	TA0008 - Lateral Movement	Configuration - SMB	Low	List	Audit	True	False	Check whether SMBv1 is enabled (server), and whether signing is required (server and client).
71	CONFIG_PRINTNIGHTMARE	Invoke-PointAndPrintConfigurationCheck	TA0004 - Privilege Escalation	Configuration - Point and Print	High	List	Base	True	False	Check whether the Print Spooler service is enabled and if the Point and Print configuration allows non-administrator users to install printer drivers.
72	CONFIG_MSI_REPAIR_UAC_PROMPT	Invoke-MsiAutomaticRepairUacPromptCheck	TA0004 - Privilege Escalation	Configuration - Application Repair UAC Prompt	Medium	List	Extended	True	False	Check whether the UAC prompt displayed when attempting an application repair through the Windows Installer was disabled.
73	CONFIG_MSI_REPAIR_WHITELIST	Invoke-MsiAutomaticRepairWhitelistCheck	TA0004 - Privilege Escalation	Configuration - Application Repair Whitelist	Low	List	Base	True	False	Check whether a whitelist of MSI packages is set in the registry to disable UAC prompts, and whether they have custom actions that may be leveraged for local privilege escalation.
74	CONFIG_COINSTALLERS	Invoke-DriverCoInstallerCheck	TA0004 - Privilege Escalation	Configuration - Driver Co-Installers	Low	List	Audit	True	False	Check whether Driver Co-installers are disabled. A local user might be able to gain SYSTEM privileges by plugging in a device such as a mouse or keyboard with a vulnerable Driver Co-installer.
75	CONFIG_SCCM_CACHE_FOLDERS	Invoke-SccmCacheFolderCheck	TA0043 - Reconnaissance	Configuration - SCCM Cache Folders	None	List	Extended	True	False	Get information about SCCM cache folders (incl. number and list of binary, script, and text files).
76	CONFIG_COM_REGISTRY_PERMISSIONS	Invoke-ComServerRegistryPermissionCheck	TA0004 - Privilege Escalation	Configuration - COM registry permissions	Medium	List	Extended	False	False	Check whether the current user has any modification rights on a COM server in the registry. This may not necessarily result in a privilege escalation. Further analysis is required.
77	CONFIG_COM_IMAGE_PERMISSIONS	Invoke-ComServerImagePermissionCheck	TA0004 - Privilege Escalation	Configuration - COM Image File Permissions	Medium	List	Extended	False	False	Check whether the current user has any modification rights on a COM server module file. This may not necessarily result in a privilege escalation. Further analysis is required.
78	CONFIG_COM_GHOST_DLL	Invoke-ComServerGhostDllHijackingCheck	TA0004 - Privilege Escalation	Configuration - COM Server Ghost DLLs	Medium	List	Extended	True	False	Check whether there are COM servers registered with a non-existent module using a relative path. This may not necessarily result in a privilege escalation. You would also need to have rights to create files in a PATH folder. Further analysis is required.
79	CONFIG_COM_MISSING_MODULE	Invoke-ComServerMissingModuleFileCheck	TA0003 - Persistence	Configuration - COM Missing Image Files	Low	List	Extended	True	False	Check whether there are leftover COM servers registered with non-existent modules. Such issues could be leveraged for lateral movement or persistence.
80	CONFIG_PROXY_AUTO_CONFIG	Invoke-ProxyAutoConfigurationCheck	TA0001 - Initial Access	Configuration - Proxy Auto-Configuration (PAC)	Low	List	Audit	True	False	Check whether Web Proxy Auto-Discovery (WPAD) is enabled, and whether a Proxy Auto-Configuration (PAC) file is distributed over HTTPS.
81	CONFIG_DEFENDER_EXCLUSIONS	Invoke-DefenderExclusionCheck	TA0005 - Defense Evasion	Configuration - Windows Defender Exclusions	None	Table	Extended	True	False	Get information about the exclusions configured in Microsoft Defender.
82	CONFIG_MDE_SETTINGS	Invoke-DefenderForEndpointConfigurationCheck	TA0005 - Defense Evasion	Configuration - MDE State and Settings	None	List	Extended	True	False	Get information about Microsoft Defender for Endpoint state and configuration.
83	NET_FIREWALL_PROFILES	Invoke-NetworkFirewallProfileCheck	TA0008 - Lateral Movement	Network - Windows Firewall Profiles	Low	List	Audit	True	False	Check whether the Windows firewall is enabled on each network profile (domain, private, public).
84	NET_ADAPTERS	Invoke-NetworkAdapterCheck	TA0043 - Reconnaissance	Network - Interfaces	None	List	Extended	True	False	Get information about all active Ethernet adapters.
85	NET_TCP_ENDPOINTS	Invoke-TcpEndpointCheck	TA0004 - Privilege Escalation	Network - TCP Endpoints	None	Table	Extended	False	False	Get information about all the TCP ports that are in a LISTEN state. Note that the associated process is also listed.
86	NET_UDP_ENDPOINTS	Invoke-UdpEndpointCheck	TA0004 - Privilege Escalation	Network - UDP Endpoints	None	Table	Extended	True	False	Get information about all the UDP ports that are in a LISTEN state. Note that the associated process is also listed. DNS is filtered out to minimize the output.
87	NET_WLAN	Invoke-WlanProfileCheck	TA0001 - Initial Access	Network - Wi-Fi Profiles	Low	List	Extended	True	False	Get information about saved Wi-Fi profiles. Clear-text pre-shared keys (PSK) are displayed when possible, and potentially vulnerable 802.1x profiles are listed.
88	NET_AIRSTRIKE	Invoke-AirstrikeAttackCheck	TA0001 - Initial Access	Network - Network Selection From Lock Screen	Low	List	Extended	True	False	Check whether the 'Do not display network selection UI' policy is enabled on workstations (CVE-2021-28316 - Airstrike attack).
89	UPDATE_HISTORY	Invoke-WindowsUpdateCheck	TA0004 - Privilege Escalation	Updates - Last Windows Update Date	None	Table	Extended	True	False	Get information about the latest Windows update. Note that this check might be unreliable.
90	UPDATE_HOTFIX	Invoke-HotFixCheck	TA0004 - Privilege Escalation	Updates - Update History	Medium	Table	Base	True	False	Check whether a Windows security update was installed within the last 31 days.
91	UPDATE_BIOS_RELEASE_DATE	Invoke-BiosUpdateCheck	TA0001 - Initial Access	Updates - BIOS Release Date	Low	List	Audit	True	False	Check whether the BIOS was installed or updated in the last 180 days.
92	MISC_LEAKED_HANDLES	Invoke-ExploitableLeakedHandleCheck	TA0004 - Privilege Escalation	Misc - Exploitable Leaked Handles	Medium	List	Extended	False	False	Check whether the current user has access to a process that contains a leaked handle to a privileged process, thread, or file object.
93	MISC_PROC_THREAD_PERMISSIONS	Invoke-ProcessAndThreadPermissionCheck	TA0004 - Privilege Escalation	Misc - Process and Thread Permissions	High	List	Base	False	False	Check whether the current user has any privileged access right on a Process or Thread they do not own.
94	MISC_MSI_CUSTOM_ACTIONS	Invoke-MsiCustomActionCheck	TA0004 - Privilege Escalation	Misc - MSI Unsafe Custom Actions	None	List	Experimental	True	False	Get information about cached MSI files that execute potentially unsafe Custom Actions. Note that a manual analysis is required to determine if the returned MSI files are actually vulnerable.
95	MISC_AVEDR	Invoke-EndpointProtectionCheck	TA0005 - Defense Evasion	Misc - Endpoint Protection Software	None	Table	Extended	True	False	Get information about the installed security products (AV, EDR). Note that this check follows a keyword-based approach and thus might not be completely reliable.
96	MISC_AMSI_PROVIDERS	Invoke-AmsiProviderCheck	TA0005 - Defense Evasion	Misc - AMSI Providers	None	List	Extended	True	False	Get information about AMSI providers registered by antimalware software.
97	MISC_SYSINFO	Invoke-SystemInformationCheck	TA0043 - Reconnaissance	Misc - System Information	None	List	Extended	True	False	Get information about the Windows version. Note that this information might be useful if the update history cannot be obtained.
98	MISC_ADMINS	Invoke-LocalAdminGroupCheck	TA0043 - Reconnaissance	Misc - Local Administrators Group	None	Table	Extended	True	False	Get information about the users and groups in the local 'Administrators' group.
99	MISC_USER_SESSION_LIST	Invoke-UserSessionCheck	TA0004 - Privilege Escalation	Misc - User Sessions	None	Table	Base	True	False	Get information about the currently logged-on users. Note that it might be possible to capture or relay the NTLM/Kerberos authentication of these users (RemotePotato0, KrbRelay).
100	MISC_HOMES	Invoke-UserHomeFolderCheck	TA0043 - Reconnaissance	Misc - User Home Folders	None	Table	Extended	False	False	Get information about the local home folders and check whether the current user has read or write permissions.
101	MISC_MACHINE_ROLE	Invoke-MachineRoleCheck	TA0043 - Reconnaissance	Misc - Machine Role	None	Table	Extended	True	False	Get information about the machine's role. Is it a Workstation, a Server, or a Domain Controller.
102	MISC_STARTUP_EVENTS	Invoke-SystemStartupHistoryCheck	TA0004 - Privilege Escalation	Misc - System Startup History	None	Table	Extended	True	False	Get information about the startup history. Note that this information might be useful if the exploitation of a service requires a reboot but the current user does not have the privileges to shut down the system.
103	MISC_DRIVES	Invoke-SystemDriveCheck	TA0043 - Reconnaissance	Misc - Filesystem Drives	None	Table	Extended	True	False	Get information about the partitions, removable storages, and mapped network shares.
104	MISC_NAMED_PIPES	Invoke-NamedPipePermissionCheck	TA0004 - Privilege Escalation	Misc - Named Pipe Permissions	None	List	Extended	False	False	Get information about named pipes with a DACL that grants write access to the current user.