caseysmithrc
27 lines
686 B
YAML
27 lines
686 B
YAML
---
|
|
attack_technique: T1134
|
|
display_name: Access Token Manipulation
|
|
|
|
atomic_tests:
|
|
- name: Access Token Manipulation
|
|
description: |
|
|
Creates a process as another user
|
|
Requires Administrator Privileges To Execute Test
|
|
supported_platforms:
|
|
- windows
|
|
input_arguments:
|
|
target_user:
|
|
description: Username To Steal Token From
|
|
type: String
|
|
default: SYSTEM
|
|
executor:
|
|
name: powershell
|
|
command: |
|
|
#list processes by user,
|
|
|
|
$owners = @{}
|
|
gwmi win32_process |% {$owners[$_.handle] = $_.getowner().user}
|
|
get-process | select processname,Id,@{l="Owner";e={$owners[$_.id.tostring()]}}
|
|
#Steal Token
|
|
. .\src\T1134.ps1
|