-
-
Notifications
You must be signed in to change notification settings - Fork 205
Obtain process token impersonation level #208
Copy link
Copy link
Open
Labels
good first issueneeds: docsIndicates that the issue needs documentation updatesIndicates that the issue needs documentation updatesneeds: filtersIndicates that new filters should be addedIndicates that new filters should be addedscope: filtersAnything related to filtersAnything related to filtersscope: peAnything related to PE introspectionAnything related to PE introspection
Description
Metadata
Metadata
Assignees
Labels
good first issueneeds: docsIndicates that the issue needs documentation updatesIndicates that the issue needs documentation updatesneeds: filtersIndicates that new filters should be addedIndicates that new filters should be addedscope: filtersAnything related to filtersAnything related to filtersscope: peAnything related to PE introspectionAnything related to PE introspection
Description
Token information class supplied to the
GetTokenInformationAPI calls permits consulting the process token impersonation details. More specifically,TokenTypeclass indicates if the token is the primary/impersonated token.References
https://learn.microsoft.com/en-us/windows/win32/api/winnt/ne-winnt-token_information_class