Privileges vs Permissions: Eliminating a Foundational Confusion

Concept

In Windows security, authorization is split into two complementary layers managed by the Security Reference Monitor (SRM):

System Privileges (User Rights Assignment): Configured in local security policies (secpol.msc) or enforced via GPOs. Embedded directly in the Access Token as LUID constants (e.g., SeDebugPrivilege, SeTakeOwnershipPrivilege). They confer the authority to bypass standard object access checks to execute low-level kernel and administration routines.
Object Permissions (Object Access Rights): Defined within the Discretionary Access Control Lists (DACL) of specific securable objects (files, registry keys, services, processes, Active Directory containers). Enforced via access masks such as FILE_READ_DATA or ADS_RIGHT_DS_WRITE_PROP.

Why This Matters in DFIR

Conflating privileges and permissions obscures root-cause analysis during incident triage:

The Illusion of ACL Protection: An administrator configures a sensitive folder with DACL: Deny Everyone. An attacker holding SeTakeOwnershipPrivilege seizes ownership and rewrites the DACL. An attacker holding SeBackupPrivilege reads the files without altering the DACL.
Local Privilege Escalation Triage: Potato exploits do not exploit file permission misconfigurations; they weaponize the SeImpersonatePrivilege legitimately assigned to service accounts (see Doc 06: Windows Access Tokens and Security Context).
Active Directory Scope: In AD, delegated administration consists of permissions on directory objects (e.g., Reset-Password on an OU), whereas interactive DC logon is governed by an operating system privilege (SeInteractiveLogonRight).

Critical Privileges & Abuse Vectors

Privilege	Display Name	DFIR Abuse Vector
`SeDebugPrivilege`	Debug programs	Grants `PROCESS_ALL_ACCESS` on any running process. Weaponized by `Mimikatz` to inspect and dump `lsass.exe` memory.
`SeBackupPrivilege`	Back up files and directories	Bypasses all file DACLs via `FILE_FLAG_BACKUP_SEMANTICS`. Enables offline theft of `ntds.dit` and `HKLM\SAM`.
`SeRestorePrivilege`	Restore files and directories	Bypasses write DACLs to overwrite arbitrary system binaries and service executables.
`SeTakeOwnershipPrivilege`	Take ownership of files or objects	Overrides object ownership, conferring immediate `WRITE_DAC` authority to rewrite access rules.
`SeImpersonatePrivilege`	Impersonate a client after authentication	Enables named pipe impersonation attacks (PrintSpoofer, Potato family) to elevate service accounts to `SYSTEM`.
`SeLoadDriverPrivilege`	Load and unload device drivers	Enables Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate EDRs in kernel space (Ring 0).

Forensic Artifacts

EventID: 4672 # Special Privileges Assigned to New Logon
SubjectUserName: Administrator
PrivilegeList:
  SeDebugPrivilege
  SeBackupPrivilege
  SeRestorePrivilege
  SeTakeOwnershipPrivilege
  SeImpersonatePrivilege

EventID: 4704 # User Right Assigned (Local Policy Tampering)
TargetUser: S-1-5-21-111111111-222222222-333333333-1105
UserRight: SeDebugPrivilege

Key Takeaways

Privilege = Global OS capability; Permission = Discrete access right on an object (DACL).
Specific privileges (SeBackup, SeTakeOwnership) completely override object DACLs.
SeDebugPrivilege and SeImpersonatePrivilege represent the primary local escalation vectors.
Event ID 4672 provides authoritative proof of privileged token instantiation.