Skip to content

Instantly share code, notes, and snippets.

@mathieucaroff

mathieucaroff/findautoelevate.ps1

Forked from Evilcry/findautoelevate.ps1
Created August 19, 2021 21:24
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save mathieucaroff/21d81d70617e1b8eb07bc6aa4f38e7b6 to your computer and use it in GitHub Desktop.
Save mathieucaroff/21d81d70617e1b8eb07bc6aa4f38e7b6 to your computer and use it in GitHub Desktop.
Download ZIP
Enumerate executables with auto-elevation enabled
Raw
findautoelevate.ps1
# Find Autoelevate executables
Write-Host "System32 Autoelevate Executables" -ForegroundColor Green -BackgroundColor Black
Select-String -Path C:\Windows\System32\*.exe -pattern "<AutoElevate>true"
Write-Host "`nSysWOW64 Autoelevate Executables" -ForegroundColor Green -BackgroundColor Black
Select-String -Path C:\Windows\SysWOW64\*.exe -pattern "<AutoElevate>true"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment