Cross-source coverage
T1134.003 / ATT&CK
Access Token Manipulation: Make and Impersonate Token
6 rules across 2 sources.
From MITRE ATT&CK 19.2
Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the LogonUser function. The function will return a copy of the new session's access token and the adversary can use SetThreadToken to assign the token to a thread.
This behavior is distinct from Token Impersonation/Theft in that this refers to creating a new user token instead of stealing or duplicating an existing one.
- Tactics
- Stealth · Privilege Escalation
- Platforms
- Windows
- Telemetry
-
WinEventLog:Securityetw:Microsoft-Windows-Security-Auditing
How MITRE says to detect it DET0498
Behavior‑chain detection for T1134.003 Make and Impersonate Token (Windows)
Windows Analytic 1375
A process creates a brand‑new logon session/token (LogonUser*/LsaLogonUser) and then assigns/impersonates it (SetThreadToken/ImpersonateLoggedOnUser) to run actions under that freshly created security context. Chain: (1) suspicious command or script block (e.g., runas /netonly, PowerShell P/Invoke of LogonUser) → (2) ETW/API evidence of LogonUser*/SetThreadToken → (3) Security 4624 New Logon (often LogonType=9 NewCredentials or 2/3 from a non‑interactive parent) with no interactive desktop → (4) sysmon 1 process(es) executing with the new LogonId/SID different from the parent process → (5) optional privileged ops/lateral movement.
WinEventLog:SecurityEventCode=4688WinEventLog:SecurityEventCode=4672etw:Microsoft-Windows-Security-Auditingapi_call: LogonUser(A|W), LsaLogonUser, SetThreadToken, ImpersonateLoggedOnUser
SigmaHQ/sigma
4 rules| Detection | Severity | Format |
|---|---|---|
| HackTool - SharpDPAPI Execution | High | Sigma |
| HackTool - SharpImpersonation Execution | High | Sigma |
| HackTool - Impersonate Execution | Medium | Sigma |
| Potentially Suspicious Explicit Credential Local Logon | Medium | Sigma |
elastic/detection-rules
2 rules| Detection | Severity | Format |
|---|---|---|
| Interactive Logon by an Unusual Process | High | Elastic TOML |
| Process Creation via Secondary Logon | Medium | Elastic TOML |