Cross-source coverage
T1134.002 / ATT&CK
Access Token Manipulation: Create Process with Token
From MITRE ATT&CK 19.2
Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as CreateProcessWithTokenW and runas.
Creating processes with a token not associated with the current user may require the credentials of the target user, specific privileges to impersonate that user, or access to the token to be used. For example, the token could be duplicated via Token Impersonation/Theft or created via Make and Impersonate Token before being used to create a process.
While this technique is distinct from Token Impersonation/Theft, the techniques can be used in conjunction where a token is duplicated and then used to create a new process.
- Tactics
- Stealth · Privilege Escalation
- Platforms
- Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:SysmonETW:ProcThread
How MITRE says to detect it DET0456
Behavior-chain detection for T1134.002 Create Process with Token (Windows)
Windows Analytic 1253
A process (often after stealing/creating a token) calls CreateProcessWithTokenW/CreateProcessAsUserW or uses runas to spawn a **new** process whose security context (SID/LogonId/IntegrityLevel) differs from its parent. Chain: (1) suspicious command/API → (2) privileged handle or token duplication/open → (3) new child process running as another user / higher integrity → (4) optional follow‑on privileged/lateral actions.
WinEventLog:SecurityEventCode=4688WinEventLog:SysmonEventCode=10ETW:ProcThreadapi_call: CreateProcessWithTokenW, CreateProcessAsUserWWinEventLog:SecurityEventCode=4672, 4634WinEventLog:SecurityEventCode=5136
elastic/protections-artifacts
12 rules| Detection | Severity | Format |
|---|---|---|
| Access Token Manipulation via Child Process | Undefined | Elastic TOML |
| NetworkCleartext Logon by a Suspicious Process | Undefined | Elastic TOML |
| NewCredential Logon by a Suspicious Process | Undefined | Elastic TOML |
| Potential Execution via Token Theft | Undefined | Elastic TOML |
| Potential Privilege Escalation via Rogue WinRM | Undefined | Elastic TOML |
| Potential Privilege Escalation via Token Impersonation | Undefined | Elastic TOML |
| Privilege Escalation via EXTENDED STARTUPINFO | Undefined | Elastic TOML |
| Privilege Escalation via SeImpersonatePrivilege | Undefined | Elastic TOML |
| Process Creation via Secondary Logon | Undefined | Elastic TOML |
| Suspicious Impersonation as Trusted Installer | Undefined | Elastic TOML |
+ 2 more from elastic/protections-artifacts → showing the 10 highest-severity
SigmaHQ/sigma
7 rules| Detection | Severity | Format |
|---|---|---|
| Meterpreter or Cobalt Strike Getsystem Service Installation - Security | High | Sigma |
| Meterpreter or Cobalt Strike Getsystem Service Installation - System | High | Sigma |
| Potential Meterpreter/CobaltStrike Activity | High | Sigma |
| PUA - AdvancedRun Suspicious Execution | High | Sigma |
| RedSun - Conhost.exe Spawned by TieringEngineService.exe | High | Sigma |
| Suspicious Child Process Created as System | High | Sigma |
| PUA - AdvancedRun Execution | Medium | Sigma |
elastic/detection-rules
6 rules| Detection | Severity | Format |
|---|---|---|
| Interactive Logon by an Unusual Process | High | Elastic TOML |
| Privileges Elevation via Parent Process PID Spoofing | High | Elastic TOML |
| Process Created with an Elevated Token | High | Elastic TOML |
| PowerShell Script with Token Impersonation Capabilities | Medium | Elastic TOML |
| Process Created with a Duplicated Token | Medium | Elastic TOML |
| Process Creation via Secondary Logon | Medium | Elastic TOML |
Bert-JanP/Hunting-Queries-Detection-Rules
5 rules| Detection | Severity | Format |
|---|---|---|
| All BlackCat/ALPHV Ransomware IOCs with one KQL query | Undefined | KQL |
| Encoded Powershell Commands With Web Request | Undefined | KQL |
| MITRE ATT&CK Mapping | Undefined | KQL |
| Runas with saved credentials | Undefined | KQL |
| Sliver C2 Beacon Loaded | Undefined | KQL |
splunk/security_content
1 rule| Detection | Severity | Format |
|---|---|---|
| Windows Access Token Manipulation SeDebugPrivilege | Undefined | SPL |