trustme

trustme BOF to impersonate TrustedInstaller via DISM API trigger and thread impersonation. What this does Elevates a Cobalt Strike Beacon from an admin context to NT AUTHORITY\SYSTEM with the NT SERVICE\TrustedInstaller SID in the token groups. This gives you the ability to modify files, registry...