TW-D 4f6cd4b54d
Execution - Get System (#446)
Disable "PowerShell" logging
Check if current process have "Administrator" privilege
Check "SeDebugPrivilege" policy
Retrieves the processes belonging to the "SYSTEM" account
For each system PID, test to obtain the "SYSTEM" account via the parent process
2021-08-16 07:43:01 -05:00
..
2021-08-16 07:43:01 -05:00
2021-08-16 07:43:01 -05:00
2021-08-16 07:43:01 -05:00