Detailed listings of builtin groups:

https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory

https://ss64.com/nt/syntax-security_groups.html

Groups to always check:

Backup Operators

Different methods do the same

PoC Module

https://github.com/giuliano108/SeBackupPrivilege

Check enablement:

Get-SeBackupPrivilege

To enable the privilege:

Set-SeBackupPrivilege

Copying a protected file: