Windows Privilege-Escalation Reconnaissance Scripts

Automated scripts that enumerate a Windows host for privesc paths, complementing the manual built-ins in windows-reconnaissance-commands. Each trades noise/coverage differently — pick based on whether the target runs Defender, whether you can upload binaries, and whether analysis must happen off-host.

Tool comparison

Tool	Type	Runs on target	Notes
WinPEAS	Compiled C# / .exe	Yes	Broad coverage (credentials, services, tokens, patches). Detected and quarantined by Microsoft Defender by default — obfuscate or use the obfuscated releases.
PowerUp	PowerShell	Yes	Misconfiguration-focused (unquoted service paths, weak service ACLs, AlwaysInstallElevated). May need powershell -nop -exec bypass, which is itself alerting. See powerup-powersploit.
PrivescCheck	PowerShell	Yes	Maintained successor to PowerUp-style checks; built-in reporting (TXT/HTML/CSV), no offensive exploitation built in.
Windows Exploit Suggester	Python	No	Parses systeminfo output against the Microsoft bulletin database — run on the attacker’s machine with exfiltrated systeminfo.
multi/recon/local_exploit_suggester	Metasploit module	Through an existing meterpreter session	Maps installed patch level to known local exploits; quiet, but requires an existing session.

Operational notes

• Defender catches WinPEAS on disk. Alternatives: run the .NET assembly in memory (e.g., via execute-assembly), use an obfuscated build, or fall back to PowerShell scripts with AMSI bypass (see amsi-bypass).
• PowerShell execution policy is not a security boundary — powershell -nop -exec bypass defeats it — but the command line is high-signal telemetry. Prefer IEX download cradles (see invoke-webrequest-download-cradles) with AMSI patched first.
• Off-host analysis is quietest: systeminfo → Windows Exploit Suggester, or wmic qfe → manual bulletin lookup, generates no suspicious on-target process activity.
• Combine with credential-focused enumeration (windows-saved-credentials, unattended-installation-credentials, registry-run-keys-and-startup-folder) — the scripts surface patches and misconfigs, not every secret.

Sources

• PEASS-ng - Privilege Escalation Awesome Scripts SUITE new generation
• PowerSploit — Privesc Module
• PrivescCheck
• Windows Exploit Suggester
• Local Exploit Suggester (Metasploit)

Related: windows-reconnaissance-commands, amsi-bypass, disable-microsoft-defender, exploit-windows-services-unquoted-paths, net-windows-command, get-winevent, powerup-powersploit