From c4b7a83938cc9c1d763cc9bf49c6fcc2fdc4f76b Mon Sep 17 00:00:00 2001
From: yardenshafir <yardenshafir2@gmail.com>
Date: Wed, 25 May 2022 09:49:21 -0400
Subject: [PATCH] Create appcontainers.txt

Print all processes running as appcontainers
---
 appcontainers.txt | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 appcontainers.txt

diff --git a/appcontainers.txt b/appcontainers.txt
new file mode 100644
index 0000000..ac25560
--- /dev/null
+++ b/appcontainers.txt
@@ -0,0 +1,3 @@
+# Get all appcontainer processes (makred by Token.TokenFlags.LowBox (value == 0x4000)
+
+dx -g @$appcontainers = @$cursession.Processes.Select(p => new {Name = p.Name, Id = p.Id, ProcessObj = p, TokenFlags = ((nt!_TOKEN*)(p.KernelObject.Token.Object & ~0xf))->TokenFlags}).Where(p => (p.TokenFlags & 0x4000) == 0x4000)