Windows

Look for:

• PrintNightmare

• SamTheAdmin

• SecretSam/ HiveNightmare

• Poor Password management – i.e. ThisIsUserPassword01 ThisIsAdminPassword01

• SeImpersonatePrivilege/SeAssignPrimaryToken --> JuicyPotato

• SeChangeNotifyPrivilege & SeImpersonatePrivilege--> PrintSpoofer

• SMBGhost -