Access Token Manipulation T1134

Tactics: Stealth, Privilege Escalation

Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.

Events covered

22 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 73 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (101 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
CommandLine14contains 13, ends_with 2, match 1, regex_match 1/user:, -decode , -e* IAB, -e* JAB, -spawnto
EventID13eq 12, in 110, 4738, 4742, 5136, 1
Image12ends_with 8, in 2, contains 1, starts_with 1, wildcard 1*\\\\*, *\\programdata\\*, *\\temp\\*, \cmd.exe, :\program files (x86)\java\
EventType11eq 11start, token_manipulation_event, token_protection_event, PWD_RESET, ProcessCreated
OriginalFileName8eq 6, contains 1, in 1advancedrun.exe, browsercore.exe, cmd.exe, cmstp.exe, cscript.exe
process_name7eq 5, ends_with 1, in 1cmd.exe, certutil.exe, \svchost.exe, autochk.exe, bitsadmin.exe
ParentImage6ends_with 3, in 2, contains 1, is_not_null 1*\\\\*, *\\programdata\\*, *\\temp\\*, :\packages\plugins\microsoft.guestconfiguration.configura..., :\program files (x86)\java\
Channel5eq 5, in 5
IntegrityLevel5eq 5, in 2System, High, Low, Medium
LogonProcessName5starts_with 3, eq 2Advapi, seclogo
LogonType5eq 5Interactive, NewCredentials, Network
eventtype5eq 5
endgame.event_subtype_full4eq 4token_manipulation_event, token_protection_event
endgame.metadata.type4eq 4detection, prevention
event.category4eq 4process, authentication, iam

Top indicator values (852 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
IntegrityLeveleq
System
529
event.kindeq
alert
436
event.moduleeq
endgame
415
event.typeeq
start
4606
EventIDeq
10
316
EventIDeq
5136
330
EventIDeq
4738
26
EventIDeq
4742
26
EventTypeeq
start
316
EventTypeeq
token_manipulation_event
22
EventTypeeq
token_protection_event
22
usercontains
authori
314
usercontains
autori
314
CommandLinecontains
/user:
27
GrantedAccesseq
0x1040
22
Imageends_with
\cmd.exe
2130
Imagein
*\\\\*
22
Imagein
*\\programdata\\*
24
Imagein
*\\temp\\*
25
Imagein
*\\users\\*
22
IntegrityLevelin
High
25
IntegrityLevelin
Low
23
IntegrityLevelin
Medium
23
LogonProcessNamestarts_with
Advapi
22
LogonTypeeq
Interactive
25
LogonTypeeq
NewCredentials
28
ParentImagein
*\\\\*
22
ParentImagein
*\\programdata\\*
22
ParentImagein
*\\temp\\*
23
ParentImagein
*\\users\\*
22

Exclusions (222 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
Imageeq
?:\windows\system32\werfault.exe
3
Imageeq
?:\windows\system32\werfaultsecure.exe
3
Imageeq
?:\windows\syswow64\werfault.exe
3
Imageeq
?:\windows\syswow64\werfaultsecure.exe
3
Imageeq
?:\windows\softwaredistribution\download\install\securityhealthsetup.exe
2
Imageeq
?:\windows\system32\wermgr.exe
2
SidHistoryin
%%1793
3
SidHistoryin
-
3
Imagein
%systemroot%\\*
2
Imagewildcard
?:\program files (x86)\*.exe
2
Imagewildcard
?:\program files\*.exe
2
ParentImageeq
?:\windows\system32\utilman.exe
2
ParentImagewildcard
?:\windows\system32\msiexec.exe
2
ParentImagewildcard
?:\windows\system32\svchost.exe
2
ScriptBlockTexteq
sentinelbreakpoints
2

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 20 rules

Elastic 20 rules

Splunk 14 rules

Kusto 14 rules

Panther 5 rules