mirror of
https://github.com/yardenshafir/WinDbg_Scripts
synced 2026-06-08 18:28:57 +00:00
yardenshafir
2fc6624795
Add command to dump processes whose tokens enable redirection trust mitigation
5 lines
584 B
Plaintext
5 lines
584 B
Plaintext
# Print a table of all the processes running with a token that has Redirection Trust mitigation enabled in full / audit mode
|
|
# Only looks at primany token, not at impersonation token
|
|
|
|
dx -g @$cursession.Processes.Select(p => new {Name = p.Name, RedirectionTrust = ((((nt!_TOKEN*)(p.KernelObject.Token.Object & ~0xf))->TokenFlags & 0x400000) == 0x400000), RedirectionTrustAudit = ((((nt!_TOKEN*)(p.KernelObject.Token.Object & ~0xf))->TokenFlags & 0x800000) == 0x800000)}).OrderByDescending(obj => obj.@"RedirectionTrustAudit").Where(p => p.RedirectionTrust || p.RedirectionTrustAudit)
|