PowerUp

PowerUp is PowerSploit's Windows PowerShell module for finding common local privilege-escalation conditions and exercising selected findings. Invoke-PrivescAudit checks the current token, service paths and permissions, DLL hijack opportunities, installer and autorun settings, scheduled-task and unattended-install files, and credentials in autologon, web/application configuration, SiteList, and cached Group Policy files. It returns candidate findings and abuse hints; results depend on the current host and user context, and a finding must be validated before treating a condition as exploitable.