Commonly Abused Windows Token Privileges: SeBackupPrivilege

SeBackupPrivilege — Back up files and directories

Determines which users can bypass file and directory, registry, and other persistent object permissions for the purposes of backing up the system. This user right is effective only when an application attempts access through the NTFS backup application programming interface (API) through a tool such as NTBACKUP.EXE. Otherwise, standard file and directory permissions apply.

GPO Setting Path

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

GPO Setting Name

Back up files and directories

Token Privilege

SeBackupPrivilege

Associated ATT&CK Tactic(s)

Collection (TA0009)