wiki created

documentation-payload/Cazalla/commands/list_tokens.md

@@ -0,0 +1,50 @@
+# list_tokens - Enumerate Tokens
+
+Enumerate and list all available security tokens from running processes on the target system.
+
+## Description
+
+The `list_tokens` command enumerates and lists all available security tokens from running processes on the target system. Shows detailed token information including user context, privileges, and groups for each process.
+
+## Syntax
+
+```
+list_tokens
+```
+
+## Examples
+
+```
+list_tokens
+```
+
+## Features
+
+- Shows detailed token information including user context, privileges, and groups for each process
+- Compatible with Mythic Process Browser for interactive token enumeration
+- Useful for reconnaissance to identify high-value tokens before attempting token theft
+- Lower detection risk than token theft operations, but token enumeration may still be logged by security tools
+
+## Output
+
+```
+PID     Process Name          User                    Domain           Privileges
+-----   -------------------   ----------------------  --------------   -------------------
+1234    lsass.exe             SYSTEM                  NT AUTHORITY      SeDebugPrivilege
+5678    explorer.exe          User                    DESKTOP-ABC      SeChangeNotifyPrivilege
+```
+
+## OPSEC Considerations
+
+- Token enumeration may be logged by security tools
+- Lower risk than token theft, but still detectable
+- Use for reconnaissance before attempting token theft
+
+## Related
+
+[Process Browser Integration](../../../features.md#process-browser-integration), [Token Support](../../../features.md#token-support)
+
+---
+
+**Command Category:** Token Operations  
+**Requires Admin:** No