SharpUp

SharpUp.exe audit

Audits the host for local privilege escalation vectors (vulnerable services, AlwaysInstallElevated, privileged tokens, DLL hijacking) compiled in .NET.

When you want a privesc scanner that doesn't rely on PowerShell (unlike PowerUp/PrivescCheck): SharpUp is a compiled binary, ideal for loading with execute-assembly from a C2 and avoiding PowerShell 4104 telemetry.

If the EDR blocks GhostPack binaries (Rubeus/Seatbelt/SharpUp are heavily signed). For a scan with more covered vectors (including tasks and ACLs), PrivescCheck -Extended is more comprehensive.