if [ = priv_list +"% |win security lookupprivilegename(none, [ ]exceptpriv_list " /areturn priv_list we use the process id to obtain handle to the target process nextwe crack open the process token and then request the token information for that process by sending the win security tokenprivileges structurewe are instructing the api call to hand back all of the privilege information for that process the function call returns list of tupleswhere the first member of the tuple is the privilege and the second member describes whether the privilege is enabled or not because we are only concerned with the privileges that are enabledwe first check for the enabled bits and then we look up the human-readable name for that privilege next we'll modify our existing code so that we're properly outputting and logging this information change the following line of code from thisprivileges " /ato the followingprivileges get_process_privileges(pidnow that we have added our privilege tracking codelet' rerun the process_monitor py script and check the output you should see privilege information as shown in the output belowc:\python exe process_monitor py ,justin- trl ld\administrator, :\windows\system notepad exe," :\windows\system \notepad exe, , ,sechangenotifyprivilege |seimpersonateprivilege|secreateglobalprivilege,justin- trl ld\administrator, :\windows\system calc exe," :\windows\system \calc exe, , ,sechangenotifyprivilegeseimpersonateprivilege|secreateglobalprivilegeyou can see that we are correctly logging the enabled privileges for these processes we could easily put some intelligence into the script to log only processes that run as an unprivileged user but have interesting privileges enabled we will see how this use of process monitoring will let us find processes that are utilizing external files insecurely