System-level security revolves around the main local system-level exploitation and the controls that are in place to bypass:

• Time zone synchronization: In most organizations, all the endpoints will sync their time with the primary domain; this provides the opportunity for an attacker to nullify evidence or track an exploit.
• Page file creating, locking pages in the memory, and create token object—some of the token objects and page files run at system level. One of the classic attacks was a hibernation file attack.
• One of the first things that penetration testers must consider when they gain access to a target system with local admin privileges is to authenticate themselves to the domain, escalate the privileges, and add a user to the domain who can create global objects and symbolic links, which will provide full access to the domain.
• Load and unload device drivers and set firmware environment values.
• Automatic administrative logon enabled for all the system users.