@startmindmap
+ Windows Privilege Escalation
++ Manual
+++ Operating System and Architecture
++++ System Information
+++++_ systeminfo
+++++_ Get-ComputerInfo
+++++_ Get-WmiObject_win32_operatingsystem_|_select_osarchitecture
+++ User Information
++++ Current User
+++++_ whoami
+++++_ Get-LocalUser
++++ Group Memberships
+++++_ whoami_/groups
+++++_ net_localgroup
+++++_ Get-LocalGroup
+++++_ Get-LocalGroupMember_[groupname]
+++ Network and Connections
++++ Active Connections
+++++_ netstat_-ano
+++++_ Get-NetTCPConnection
++++ Network Configuration
+++++_ ipconfig_/all
+++++_ Get-NetIPConfiguration
+++ Process and Task Management
++++ Running Processes
+++++_ tasklist_/m
+++++_ Get-Process
++++ Services Management
+++++_ Get-Service
+++++_ Restart-Service_ServiceName
+++++_ Start-Service_ServiceName
+++++_ Stop-Service_ServiceName
+++++_ Get-CimInstance_-ClassName_win32_service_|_Select_Name,State,PathName_|_Where-Object_{$_.State_-like_'Running'}
+++ File and Directory Enumeration
++++ Searching Files
+++++_ dir_/s_*file.txt*
+++++_ Get-ChildItem_-Recurse_-Filter_*file.txt*
++++ Listing Items
+++++_ dir
+++++_ Get-ChildItem
++++ Special File Searches
+++++_ Get-ChildItem_-Path_C:\_-Include_*.kdbx,*ini,*.txt,*.pdf,*.xls,*.xlsx,*.doc,*.docx_-File_-Recurse_-ErrorAction_SilentlyContinue
+++ Registry and Installation Information
++++ Installed Applications
+++++_ Get-ItemProperty_"HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"
+++++_ Get-ItemProperty_"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*"_|_select_displayname
+++ Permissions and Security
++++ File Permissions
+++++_ icacls_"C:\xampp\apache\bin\httpd.exe"
+++++_ icacls_"C:\Users\alex"
+++ Miscellaneous Commands
++++ Environment Variables
+++++_ set
+++++_ Get-ChildItem_Env:
++++ History and Logging
+++++_ Get-History
+++++_ (Get-PSReadlineOption).HistorySavePath
-- Automatic
---_ WinPEAS
---_ Seatbelt
---_ JAWS
---_ PowerUp
---_ Windows exploit suggester
---_ pentestmonkey/windows-privesc-check
@endmindmap