01 — Windows intermediate map

Learning objectives

• Finish local privesc classes beyond “weak service ACL” (tokens / potatoes concept, always-install-elevated, etc. as encountered)
• Harvest creds concept-first: SAM/SYSTEM offline, LSASS as store, LSA secrets — lab-only
• Deploy one persistence class and tear it down (Run key / scheduled task / service) with detection notes
• Know when to stop and move to AD intermediate

Intuition

Beginner got admin. Intermediate asks “what identities live on this box, and how do I stay without being obvious?” Domain abuse is a different track.

Intermediate path

1. Architecture refresh — identity on a box (SAM vs domain)
2. AI2 — techniques you skipped as beginner
3. AI3 Credential harvesting [Intermediate] — one method per lab, document noise
4. AI4 Persistence [Intermediate] — install → verify → remove
5. Labs

Park for later