marcos.luna
59 lines
1.9 KiB
Markdown
59 lines
1.9 KiB
Markdown
# steal_token - Steal Process Token
|
|
|
|
Steal and impersonate the security token from a target process.
|
|
|
|
## Description
|
|
|
|
The `steal_token` command steals and impersonates the security token from a target process. Opens the target process, extracts its token, and impersonates it to assume the security context (user, privileges, groups) of that process. CRITICAL OPSEC RISK: Token theft is heavily monitored by EDR/XDR solutions.
|
|
|
|
## Syntax
|
|
|
|
```
|
|
steal_token <pid>
|
|
```
|
|
|
|
## Parameters
|
|
|
|
- `pid` (required): Process ID of the process to steal the token from.
|
|
|
|
## Examples
|
|
|
|
```
|
|
steal_token 1234
|
|
steal_token 5678
|
|
```
|
|
|
|
## Features
|
|
|
|
- Opens the target process, extracts its token, and impersonates it to assume the security context (user, privileges, groups) of that process
|
|
- Compatible with Mythic Process Browser for interactive token theft
|
|
- The impersonation context is automatically tracked and displayed in the Mythic UI
|
|
- CRITICAL OPSEC RISK: Token theft is heavily monitored by EDR/XDR solutions, especially when targeting LSASS or other critical processes
|
|
- Always requires approval from another operator
|
|
- Prefer `make_token` for domain credentials when possible
|
|
|
|
## Output
|
|
|
|
```
|
|
[steal_token] Token stolen from process: explorer.exe (PID: 1234)
|
|
[steal_token] Impersonating user: DESKTOP-ABC\User
|
|
```
|
|
|
|
## OPSEC Considerations
|
|
|
|
- **CRITICAL OPSEC RISK**: Token theft is heavily monitored
|
|
- Targeting LSASS or critical processes triggers high-priority alerts
|
|
- Always requires operator approval (OPSEC pre-check blocks execution)
|
|
- Process access is logged by EDR/XDR solutions
|
|
- Consider using `make_token` instead when you have credentials
|
|
|
|
## Related
|
|
|
|
[OPSEC Checking](../../../opsec.md), [Token Support](../../../features.md#token-support), [Process Browser Integration](../../../features.md#process-browser-integration)
|
|
|
|
---
|
|
|
|
**Command Category:** Token Operations
|
|
**Requires Admin:** No
|
|
**MITRE ATT&CK:** [T1134 - Access Token Manipulation](https://attack.mitre.org/techniques/T1134/)
|