Invoke-FindDLLHijack - Differentiate between System and current user's path about powertools HOT 3 OPEN

There is a -ExcludeWindows flag as well as -ExcludeProgramFiles flag which will exclude all paths found from C:\Windows*, C:\Program Files* and C:\Program Files (x86)* . Are you thinking of a flag that filters just for the current user's directory path?

from powertools.

Not necessarily a filter, just a way to differentiate between writable directories in the current user's path(HKCU\Environment\PATH) and the system path(HKLM\System\ControlSet001\Control\Session Manager\Environment\Path?). Only writable directories in the SYSTEM path can be used for local privilege escalation, whereas writable directories in the current user's path can potentially be used for persistence or horizontal privilege escalation (but not local privilege escalation).

from powertools.

Cool, will check back into this shortly!

from powertools.