Steal a users access token and create a task
Tactic: Defense-evasion
A token theft script was executed to steal and assume the token of another user’s existing process, changing the user context of the process.
The script is then used to make registry modifications and schedule a taks to spawn a new agent in that users's context.
View Command
To view this TTPs command, you must be logged in with a professional or enterprise license.
LoginTest this TTP
Download Operator (1.7.1)
Follow @preludeorg on Twitter for new chains and more.
Join the Prelude Discord to discuss chains and more.
Keep up to date with code changes and community activity on Github