admin/yardenshafir-WinDbg_Scripts
1
0
Fork 0
mirror of https://github.com/yardenshafir/WinDbg_Scripts synced 2026-06-08 18:28:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

Create processRedirectionTrust.txt

Browse Source 
Add command to dump processes whose tokens enable redirection trust mitigation
This commit is contained in:
yardenshafir
2022-05-25 09:46:48 -04:00
committed by GitHub
parent 0bb41bc95f
commit 2fc6624795
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
processRedirectionTrust.txt
+4
View File
@@ -0,0 +1,4 @@
# Print a table of all the processes running with a token that has Redirection Trust mitigation enabled in full / audit mode
# Only looks at primany token, not at impersonation token
dx -g @$cursession.Processes.Select(p => new {Name = p.Name, RedirectionTrust = ((((nt!_TOKEN*)(p.KernelObject.Token.Object & ~0xf))->TokenFlags & 0x400000) == 0x400000), RedirectionTrustAudit = ((((nt!_TOKEN*)(p.KernelObject.Token.Object & ~0xf))->TokenFlags & 0x800000) == 0x800000)}).OrderByDescending(obj => obj.@"RedirectionTrustAudit").Where(p => p.RedirectionTrust || p.RedirectionTrustAudit)