list_tokens - Enumerate Tokens

Enumerate and list all available security tokens from running processes on the target system.

Description

The list_tokens command enumerates and lists all available security tokens from running processes on the target system. Shows detailed token information including user context, privileges, and groups for each process.

Syntax

list_tokens

Examples

list_tokens

Features

Shows detailed token information including user context, privileges, and groups for each process
Compatible with Mythic Process Browser for interactive token enumeration
Useful for reconnaissance to identify high-value tokens before attempting token theft
Lower detection risk than token theft operations, but token enumeration may still be logged by security tools

Output

PID     Process Name          User                    Domain           Privileges
-----   -------------------   ----------------------  --------------   -------------------
1234    lsass.exe             SYSTEM                  NT AUTHORITY      SeDebugPrivilege
5678    explorer.exe          User                    DESKTOP-ABC      SeChangeNotifyPrivilege

OPSEC Considerations

Token enumeration may be logged by security tools
Lower risk than token theft, but still detectable
Use for reconnaissance before attempting token theft

Process Browser Integration, Token Support

Command Category: Token Operations
Requires Admin: No

1.6 KiB Raw Blame History