Process Integrity Level

[ikiril01]

Proposed Change

We should add an integrity_level field to the Process object model, which is part of Windows' Mandatory Integrity Control.

Field	Description	Example
integrity_level	The Windows integrity level associated with the process. Must be one of: low, medium, high, or system.	high

Justification

Integrity level is a key field associated with UAC Bypass.

[johnwunder]

Only hesitation on this one is that it's Windows specific. That said, it's a critical field to understand what a process can do so I say add it. If there's a Unix equivalent (effective user account, including via setuid?) maybe that could be incorporated?

[ikiril01]

The closest Unix equivalent seems to be SELinux context, though it's not an entirely apples-to-apples comparison since it's not a core system function. As such, it would likely be more sensible to start with including the Windows-specific field.

[ikiril01]

Added in 4ef47ca