Connecting the Dots: PrivHound Transforms Windows Local Privilege Escalation into an Explorable Graph

PrivHound

Local Privilege Escalation, as a Graph.

A BloodHound OpenGraph collector that models Windows local privilege escalation as interconnected attack paths not a wall of text.

For a long time, BloodHound has proven that attackers think in graphs, transforming Active Directory misconfigurations from static checklists into explorable attack paths. Yet when it comes to local privilege escalation, the industry is still stuck in 2015: run a tool, read a wall of text, manually connect the dots or have LLM do it for you 😛

WinPEAS, PowerUp, and Seatbelt are excellent at finding individual misconfigurations, but they cannot answer questions like:

• “Does this writable Program Files directory actually lead to SYSTEM because a service runs a binary from it?”
• “Does this PowerShell history file contain credentials that are valid for a local admin?”
• “Can I read another user’s profile, find their stored credentials, log in as them, and exploit a service they have write access to?”

These tools report findings in isolation. In reality, privilege escalation is a multi-step chain where one finding feeds into another. A writable directory means nothing if no service runs from it. A credential in a history file means nothing if it doesn’t belong to a privileged user. The real question is never “what misconfigurations exist?” — it’s “what can I actually reach from here?”

If Active Directory attacks can be thought of as a graph, why not local privilege escalation?

PrivHound changes this by modeling local privilege escalation as a graph. Built on BloodHound’s OpenGraph framework, it enumerates 29 categories of Windows privilege escalation vectors, from weak service permissions to COM hijacking to WebClient relay and outputs them as interconnected nodes and edges.

The result: multi-hop escalation chains become visible, queryable with Cypher, and overlayable on top of existing Active Directory attack paths.

What It Checks

Multi-Hop Attack Paths

This is what separates PrivHound from traditional privesc tools. Instead of listing findings in isolation, PrivHound connects them into exploitable chains:

Cross-User Privilege Escalation

When PrivHound discovers valid credentials for other local users (via GPP passwords, AutoLogon, unattend files, PowerShell history, cross-user profiles, etc.), it doesn’t stop at creating a PHCanLoginAs edge. It analyzes what those discovered users can actually do.

How it works (no SeImpersonatePrivilege required):

1. LogonUser obtains a token handle for each discovered user
2. GetTokenInformation extracts group memberships (SIDs) and token privileges
3. ACL checks run using the discovered user’s groups — not the current user’s
4. Edges are created from the discovered user’s node to any vulnerable resources they can access
5. The token is closed — no impersonation occurs, no elevated privileges needed

What it checks for each discovered user:

All cross-user edges include a discovered_via="credential" property for filtering.

Download & Use

Support Our Threat Intelligence

If you find our technology report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy