fibratus icon indicating copy to clipboard operation
fibratus copied to clipboard

Obtain process token impersonation level

Open rabbitstack opened this issue 2 years ago • 0 comments

Description

Token information class supplied to the GetTokenInformation API calls permits consulting the process token impersonation details. More specifically, TokenType class indicates if the token is the primary/impersonated token.

References

https://learn.microsoft.com/en-us/windows/win32/api/winnt/ne-winnt-token_information_class

rabbitstack avatar Nov 03 '23 17:11 rabbitstack