Windows Enumeration Checklist

Phase 1 covers what to do the moment you get a shell. Phase 2 covers what to do once you have admin or SYSTEM.

Phase 1 — Enumeration
Phase 2 — Pillaging

Identity

Who am I? → System EnumerationWhat privileges do I have, and do any lead to escalation (SeImpersonate, SeBackup, SeDebug)? → System EnumerationWhat groups am I in, and are any of them privileged? → System EnumerationWhat is my SID, and what does the RID tell me about my account? → System EnumerationWhat is my integrity level — am I Medium or High? → Security Mechanisms

The Machine

What OS version and build number is this? → System EnumerationWhat patches are installed, and which are missing? → System EnumerationWhat scheduled tasks run as Administrator or SYSTEM? → System EnumerationAre any of those scheduled-task scripts writable by me? → NTFS Permissions & icacls

File System

Where can I write — ProgramData, Public, AppData? → Architecture & File SystemAre there interesting files I can find by name or extension? → Architecture & File SystemWhat shell am I in, and can I upgrade to PowerShell? → CMD, PowerShell & WMIWhat is the PowerShell execution policy, and can I bypass it? → CMD, PowerShell & WMI

Processes & Services

What processes are running, and who owns them? → Processes & ServicesAre any processes passing credentials as command-line arguments? → Processes & ServicesWhat services are running, and what accounts do they run as? → Processes & ServicesCan I change any service’s configuration (weak service permissions)? → Processes & ServicesCan I overwrite any service binary? → Processes & ServicesAre there any unquoted service paths I can hijack? → Processes & ServicesCan I write to any service’s registry key? → Processes & Services

Network & Remote Access

What is the network configuration and what ports are listening? → CMD, PowerShell & WMIIs RDP or WinRM available, and am I in the group that can use it? → Remote Access & SessionsWhat SMB shares exist, and what can I read or write? → SMB & Network SharesIs anonymous/null session access allowed on any share? → SMB & Network SharesIs the host vulnerable to a known SMB exploit (EternalBlue)? → SMB & Network Shares

Registry & Autostart

What autostart entries exist in the Run and RunOnce keys? → The Windows RegistryDo any autostart entries point to a path I can write to? → The Windows Registry

Security Mechanisms

Is Windows Defender running, and are there any exclusion paths? → Security MechanismsIs AppLocker enforced, and are there writable trusted paths to bypass it? → Security MechanismsWhat does Group Policy enforce on this machine? → Security Mechanisms

Windows