Cross-source coverage
T1134.001 / ATT&CK
Access Token Manipulation: Token Impersonation/Theft
29 rules across 4 sources.
From MITRE ATT&CK 19.2
Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using DuplicateToken or DuplicateTokenEx. The token can then be used with ImpersonateLoggedOnUser to allow the calling thread to impersonate a logged on user's security context, or with SetThreadToken to assign the impersonated token to a thread.
An adversary may perform Token Impersonation/Theft when they have a specific, existing process they want to assign the duplicated token to. For example, this may be useful for when the target user has a non-network logon session on the system.
When an adversary would instead use a duplicated token to create a new process rather than attaching to an existing process, they can additionally Create Process with Token using CreateProcessWithTokenW or CreateProcessAsUserW. Token Impersonation/Theft is also distinct from Make and Impersonate Token in that it refers to duplicating an existing token, rather than creating a new one.
- Tactics
- Stealth · Privilege Escalation
- Platforms
- Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:SysmonETW:Token
How MITRE says to detect it DET0482
Behavior-chain detection for T1134.001 Access Token Manipulation: Token Impersonation/Theft on Windows
Windows Analytic 1324
Detection of token duplication and impersonation attempts by correlating suspicious command-line executions (e.g., runas) with API calls to DuplicateToken, DuplicateTokenEx, ImpersonateLoggedOnUser, or SetThreadToken. The chain includes the initial command execution or in-memory API invocation → token handle duplication or thread token assignment → a new or existing process assuming the impersonated user's context.
WinEventLog:SecurityEventCode=4688WinEventLog:SysmonEventCode=10ETW:Tokenapi_call: DuplicateTokenEx, ImpersonateLoggedOnUser, SetThreadToken
SigmaHQ/sigma
9 rules| Detection | Severity | Format |
|---|---|---|
| HackTool - Koh Default Named Pipe | Critical | Sigma |
| HackTool - NoFilter Execution | High | Sigma |
| HackTool - SharpDPAPI Execution | High | Sigma |
| HackTool - SharpImpersonation Execution | High | Sigma |
| Meterpreter or Cobalt Strike Getsystem Service Installation - Security | High | Sigma |
| Meterpreter or Cobalt Strike Getsystem Service Installation - System | High | Sigma |
| Potential Meterpreter/CobaltStrike Activity | High | Sigma |
| HackTool - Impersonate Execution | Medium | Sigma |
| Potential Access Token Abuse | Medium | Sigma |
elastic/protections-artifacts
8 rules| Detection | Severity | Format |
|---|---|---|
| NetworkCleartext Logon by a Suspicious Process | Undefined | Elastic TOML |
| NewCredential Logon by a Suspicious Process | Undefined | Elastic TOML |
| Potential Execution via Token Theft | Undefined | Elastic TOML |
| Potential Privilege Escalation via Rogue WinRM | Undefined | Elastic TOML |
| Potential Privilege Escalation via Token Impersonation | Undefined | Elastic TOML |
| Privilege Escalation via SeImpersonatePrivilege | Undefined | Elastic TOML |
| Process Creation via Secondary Logon | Undefined | Elastic TOML |
| Suspicious Impersonation as Trusted Installer | Undefined | Elastic TOML |
elastic/detection-rules
7 rules| Detection | Severity | Format |
|---|---|---|
| Permission Theft - Detected - Elastic Endgame | High | Elastic TOML |
| Privilege Escalation via Named Pipe Impersonation | High | Elastic TOML |
| Privilege Escalation via Rogue Named Pipe Impersonation | High | Elastic TOML |
| First Time Seen NewCredentials Logon Process | Medium | Elastic TOML |
| Permission Theft - Prevented - Elastic Endgame | Medium | Elastic TOML |
| PowerShell Script with Token Impersonation Capabilities | Medium | Elastic TOML |
| Process Created with a Duplicated Token | Medium | Elastic TOML |
splunk/security_content
5 rules| Detection | Severity | Format |
|---|---|---|
| Runas Execution in CommandLine | Undefined | SPL |
| Windows Access Token Manipulation Winlogon Duplicate Token Handle | Undefined | SPL |
| Windows Access Token Winlogon Duplicate Handle In Uncommon Path | Undefined | SPL |
| Windows Handle Duplication in Known UAC-Bypass Binaries | Undefined | SPL |
| Windows Wermgr Spawning System Integrity Process | Undefined | SPL |