mirror of
https://github.com/Aryma-f4/Ares-mythic.git
synced 2026-06-14 16:14:13 +00:00
36 lines
695 B
Markdown
36 lines
695 B
Markdown
|
+++
|
||
|
|
title = "ticket_cache_list"
|
||
|
|
chapter = false
|
||
|
|
weight = 103
|
||
|
|
hidden = false
|
||
|
|
+++
|
||
|
|
|
||
|
|
{{% notice info %}}
|
||
|
|
Artifacts Generated: WindowsAPIInvoke
|
||
|
|
{{% /notice %}}
|
||
|
|
|
||
|
|
## Summary
|
||
|
|
list information about all loaded tickets in the current active logon session. This uses lsa apis to return all relevant information about the tickets in the current session.
|
||
|
|
If ran from an elevated context this also gets information on tickets in all sessions.
|
||
|
|
|
||
|
|
|
||
|
|
### Arguments
|
||
|
|
|
||
|
|
|
||
|
|
#### luid
|
||
|
|
Optional argument to filter the tickets in the agents store to ones matching a specified luid.
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
## Usage
|
||
|
|
```
|
||
|
|
ticket_cache_list -luid [luidValue]
|
||
|
|
```
|
||
|
|
|
||
|
|
Example
|
||
|
|
```
|
||
|
|
ticket_cache_list -luid [luidValue]
|
||
|
|
```
|
||
|
|
|
||
|
|
## MITRE ATT&CK Mapping
|
||
|
|
- T1550
|