wiki created

documentation-payload/Cazalla/commands/steal_token.md

@@ -0,0 +1,58 @@
+# steal_token - Steal Process Token
+
+Steal and impersonate the security token from a target process.
+
+## Description
+
+The `steal_token` command steals and impersonates the security token from a target process. Opens the target process, extracts its token, and impersonates it to assume the security context (user, privileges, groups) of that process. CRITICAL OPSEC RISK: Token theft is heavily monitored by EDR/XDR solutions.
+
+## Syntax
+
+```
+steal_token <pid>
+```
+
+## Parameters
+
+- `pid` (required): Process ID of the process to steal the token from.
+
+## Examples
+
+```
+steal_token 1234
+steal_token 5678
+```
+
+## Features
+
+- Opens the target process, extracts its token, and impersonates it to assume the security context (user, privileges, groups) of that process
+- Compatible with Mythic Process Browser for interactive token theft
+- The impersonation context is automatically tracked and displayed in the Mythic UI
+- CRITICAL OPSEC RISK: Token theft is heavily monitored by EDR/XDR solutions, especially when targeting LSASS or other critical processes
+- Always requires approval from another operator
+- Prefer `make_token` for domain credentials when possible
+
+## Output
+
+```
+[steal_token] Token stolen from process: explorer.exe (PID: 1234)
+[steal_token] Impersonating user: DESKTOP-ABC\User
+```
+
+## OPSEC Considerations
+
+- **CRITICAL OPSEC RISK**: Token theft is heavily monitored
+- Targeting LSASS or critical processes triggers high-priority alerts
+- Always requires operator approval (OPSEC pre-check blocks execution)
+- Process access is logged by EDR/XDR solutions
+- Consider using `make_token` instead when you have credentials
+
+## Related
+
+[OPSEC Checking](../../../opsec.md), [Token Support](../../../features.md#token-support), [Process Browser Integration](../../../features.md#process-browser-integration)
+
+---
+
+**Command Category:** Token Operations  
+**Requires Admin:** No  
+**MITRE ATT&CK:** [T1134 - Access Token Manipulation](https://attack.mitre.org/techniques/T1134/)