but with a twist as Crassus is utilizing the SysInternals Process Monitor and is parsing raw PML log files. Did you really make yet another privilege escalation discovery tool? The ACLs used by files and directories of privileged processes can find more than just looking for missing files to achieve the goal. Using Spartacus as a starting point, we created Crassus to extend Windows privilege escalation finding capabilities beyond simply looking for missing files. Code executed with unexpected privilegesĪccenture made a tool called Spartacus, which finds DLL hijacking opportunities on Windows.Did you really make yet another privilege escalation discovery tool?.Investigate any green colored results and the corresponding entries in results.csv.Reset the default Process Monitor filter using Ctrl-R.When prompted, save the boot log, e.g., to raw.PML.Once you have logged in and Windows has settled, run Process Monitor once again.In Process Monitor, select the Enable Boot Logging option.Crassus Windows privilege escalation discovery tool Quick start

Process monitor boot logging