Angerona/documentation-payload/Angerona/commands/steal_token.md

steal_token - Steal Process Token

Steal and impersonate the security token from a target process.

Description

The steal_token command steals and impersonates the security token from a target process. Opens the target process, extracts its token, and impersonates it to assume the security context (user, privileges, groups) of that process. CRITICAL OPSEC RISK: Token theft is heavily monitored by EDR/XDR solutions.

Syntax

steal_token <pid>

Parameters

• pid (required): Process ID of the process to steal the token from.

Examples

steal_token 1234
steal_token 5678

Features

• Opens the target process, extracts its token, and impersonates it to assume the security context (user, privileges, groups) of that process
• Compatible with Mythic Process Browser for interactive token theft
• The impersonation context is automatically tracked and displayed in the Mythic UI
• CRITICAL OPSEC RISK: Token theft is heavily monitored by EDR/XDR solutions, especially when targeting LSASS or other critical processes
• Always requires approval from another operator
• Prefer make_token for domain credentials when possible

Output

[steal_token] Token stolen from process: explorer.exe (PID: 1234)
[steal_token] Impersonating user: DESKTOP-ABC\User

OPSEC Considerations

• CRITICAL OPSEC RISK: Token theft is heavily monitored
• Targeting LSASS or critical processes triggers high-priority alerts
• Always requires operator approval (OPSEC pre-check blocks execution)
• Process access is logged by EDR/XDR solutions
• Consider using make_token instead when you have credentials

Related

OPSEC Checking, Token Support, Process Browser Integration

---

Command Category: Token Operations
Requires Admin: No
MITRE ATT&CK: T1134 - Access Token Manipulation