Commonly Abused Windows Token Privileges: SeDebugPrivilege

SeDebugPrivilege — Debug programs

Determines which users can attach to or open any process, even a process they do not own. Developers who are debugging their own applications do not need this user right. Developers who are debugging new system components need this user right. This user right provides access to sensitive and critical operating-system components.

GPO Setting Path

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

GPO Setting Name

Debug programs

Token Privilege

SeDebugPrivilege

Associated ATT&CK Tactic(s)

Persistence (TA0003), Privilege Escalation (TA0004), Defense Evasion (TA0005), Credential Access (TA0006)