marcos.luna
51 lines
1.6 KiB
Markdown
51 lines
1.6 KiB
Markdown
# list_tokens - Enumerate Tokens
|
|
|
|
Enumerate and list all available security tokens from running processes on the target system.
|
|
|
|
## Description
|
|
|
|
The `list_tokens` command enumerates and lists all available security tokens from running processes on the target system. Shows detailed token information including user context, privileges, and groups for each process.
|
|
|
|
## Syntax
|
|
|
|
```
|
|
list_tokens
|
|
```
|
|
|
|
## Examples
|
|
|
|
```
|
|
list_tokens
|
|
```
|
|
|
|
## Features
|
|
|
|
- Shows detailed token information including user context, privileges, and groups for each process
|
|
- Compatible with Mythic Process Browser for interactive token enumeration
|
|
- Useful for reconnaissance to identify high-value tokens before attempting token theft
|
|
- Lower detection risk than token theft operations, but token enumeration may still be logged by security tools
|
|
|
|
## Output
|
|
|
|
```
|
|
PID Process Name User Domain Privileges
|
|
----- ------------------- ---------------------- -------------- -------------------
|
|
1234 lsass.exe SYSTEM NT AUTHORITY SeDebugPrivilege
|
|
5678 explorer.exe User DESKTOP-ABC SeChangeNotifyPrivilege
|
|
```
|
|
|
|
## OPSEC Considerations
|
|
|
|
- Token enumeration may be logged by security tools
|
|
- Lower risk than token theft, but still detectable
|
|
- Use for reconnaissance before attempting token theft
|
|
|
|
## Related
|
|
|
|
[Process Browser Integration](../../../features.md#process-browser-integration), [Token Support](../../../features.md#token-support)
|
|
|
|
---
|
|
|
|
**Command Category:** Token Operations
|
|
**Requires Admin:** No
|