steal_token - Steal Process Token

Steal and impersonate the security token from a target process.

Description

The steal_token command steals and impersonates the security token from a target process. Opens the target process, extracts its token, and impersonates it to assume the security context (user, privileges, groups) of that process. CRITICAL OPSEC RISK: Token theft is heavily monitored by EDR/XDR solutions.

Syntax

steal_token <pid>

Parameters

pid (required): Process ID of the process to steal the token from.

Examples

steal_token 1234
steal_token 5678

Features

Opens the target process, extracts its token, and impersonates it to assume the security context (user, privileges, groups) of that process
Compatible with Mythic Process Browser for interactive token theft
The impersonation context is automatically tracked and displayed in the Mythic UI
CRITICAL OPSEC RISK: Token theft is heavily monitored by EDR/XDR solutions, especially when targeting LSASS or other critical processes
Always requires approval from another operator
Prefer make_token for domain credentials when possible

Output

[steal_token] Token stolen from process: explorer.exe (PID: 1234)
[steal_token] Impersonating user: DESKTOP-ABC\User

OPSEC Considerations

CRITICAL OPSEC RISK: Token theft is heavily monitored
Targeting LSASS or critical processes triggers high-priority alerts
Always requires operator approval (OPSEC pre-check blocks execution)
Process access is logged by EDR/XDR solutions
Consider using make_token instead when you have credentials

OPSEC Checking, Token Support, Process Browser Integration

Command Category: Token Operations
Requires Admin: No
MITRE ATT&CK: T1134 - Access Token Manipulation

1.9 KiB Raw Blame History