# steal_token - Steal Process Token

Steal and impersonate the security token from a target process.

## Description

The `steal_token` command steals and impersonates the security token from a target process. Opens the target process, extracts its token, and impersonates it to assume the security context (user, privileges, groups) of that process. CRITICAL OPSEC RISK: Token theft is heavily monitored by EDR/XDR solutions.

## Syntax

```
steal_token <pid>
```

## Parameters

- `pid` (required): Process ID of the process to steal the token from.

## Examples

```
steal_token 1234
steal_token 5678
```

## Features

- Opens the target process, extracts its token, and impersonates it to assume the security context (user, privileges, groups) of that process
- Compatible with Mythic Process Browser for interactive token theft
- The impersonation context is automatically tracked and displayed in the Mythic UI
- CRITICAL OPSEC RISK: Token theft is heavily monitored by EDR/XDR solutions, especially when targeting LSASS or other critical processes
- Always requires approval from another operator
- Prefer `make_token` for domain credentials when possible

## Output

```
[steal_token] Token stolen from process: explorer.exe (PID: 1234)
[steal_token] Impersonating user: DESKTOP-ABC\User
```

## OPSEC Considerations

- **CRITICAL OPSEC RISK**: Token theft is heavily monitored
- Targeting LSASS or critical processes triggers high-priority alerts
- Always requires operator approval (OPSEC pre-check blocks execution)
- Process access is logged by EDR/XDR solutions
- Consider using `make_token` instead when you have credentials

## Related

[OPSEC Checking](../../../opsec.md), [Token Support](../../../features.md#token-support), [Process Browser Integration](../../../features.md#process-browser-integration)

---

**Command Category:** Token Operations  
**Requires Admin:** No  
**MITRE ATT&CK:** [T1134 - Access Token Manipulation](https://attack.mitre.org/techniques/T1134/)