Access Token Manipulation `T1134`

Tactics: Stealth, Privilege Escalation

Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.

Events covered

24 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 10	ProcessAccess
Sysmon	Event ID 17	PipeEvent (Pipe Created)
Sysmon	Event ID 18	PipeEvent (Pipe Connected)
Security-Auditing	Event ID 4624	An account was successfully logged on.
Security-Auditing	Event ID 4648	A logon was attempted using explicit credentials.
Security-Auditing	Event ID 4674	An operation was attempted on a privileged object.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4697	A service was installed in the system.
Security-Auditing	Event ID 4703	A user right was adjusted.
Security-Auditing	Event ID 4704	A user right was assigned.
Security-Auditing	Event ID 4717	System security access was granted to an account.
Security-Auditing	Event ID 4738	A user account was changed.
Security-Auditing	Event ID 4742	A computer account was changed.
Security-Auditing	Event ID 4765	SID History was added to an account.
Security-Auditing	Event ID 4766	An attempt to add SID History to an account failed.
Security-Auditing	Event ID 5136	A directory service object was modified.
Security-Auditing	Event ID 5447	A Windows Filtering Platform filter has been changed.
Security-Auditing	Event ID 5449	A Windows Filtering Platform provider context has been changed.
1Password-ServiceAccountToken	any	Service account token (catch-all)
Defender-DeviceLogonEvents	any	Logon activity
Defender-DeviceProcessEvents	any	Process activity
Defender-DeviceProcessEvents	ProcessCreated	Process created
Service-Control-Manager	Event ID 7045	A service was installed in the system.

Authoring guide

These 99 rules share fields, values, and exclusions.

Fields filtered most (105 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	29	`eq` 29	`start`, `log_on`, `end`, `token_manipulation_event`, `token_protection_event`
`Image`	22	`ends_with` 9, `is_not_null` 4, `starts_with` 4, `in` 2, `wildcard` 2, `contains` 1, `eq` 1	, `C:\`, `\ProgramData\`, `\Temp\`, `\Users\*`
`CommandLine`	16	`contains` 13, `ends_with` 3, `match` 1, `regex_match` 1, `wildcard` 1	`-NoP` , `-W Hidden` , `-decode` , `-spawnto` , `/CommandLine`
`EventID`	15	`eq` 14, `in` 1	`10`, `4738`, `4742`, `5136`, `1`
`user.id`	15	`eq` 8, `starts_with` 6, `ne` 3, `is_not_null` 1	`S-1-5-18`, `S-1-12-`, `S-1-5-21`, `S-1-12-1-`, `S-1-5-21-`
`ParentImage`	13	`is_not_null` 6, `ends_with` 3, `in` 2, `contains` 1, `regex_match` 1, `starts_with` 1	, `\ProgramData\`, `\Temp\`, `\Users\`, `(c:\\windows\\system32\\[a-z0-9\-\_\.]+\.exe\|c:\\windows\...`
`process.parent.Ext.real.pid`	11	`gt` 10, `is_null` 1	`0`,
`process_basename`	9	`eq` 6, `in` 3	`cmd.exe`, `certutil.exe`, `msbuild.exe`, `Cmd.Exe`, `LogonUI.exe`
`OriginalFileName`	8	`eq` 5, `in` 2, `contains` 1	`Cmd.Exe`, `PowerShell.EXE`, `AdvancedRun.exe`, `PPID-spoof`, `SharpDPAPI.exe`
`event.category`	7	`eq` 7	`iam`, `authentication`, `process`
`IntegrityLevel`	6	`eq` 6, `in` 2	`System`, `S-1-16-16384`, `high`, `low`, `medium`
`Hashes`	5	`contains` 2, `ne` 2, `is_not_null` 1	, `8ba8760bcb924e1e7943c3008a80006b29737808cc41a93cabcfeaaec9785276`, `9e23e07e042943e1862b86d8c9dc05483a118938f5b19f359cb8f9aa6a14a452`, `IMPHASH=04D974875BD225F00902B4CAD9AF3FBC`, `IMPHASH=0A358FFC1697B7A07D0E817AC740DF62`
`LogonProcessName`	5	`starts_with` 3, `eq` 2	`Advapi`, `Advapi`, `seclogo`, `seclogo`
`LogonType`	5	`eq` 5	`2`, `3`, `9`, `Interactive`, `NewCredentials`
`parent_process_basename`	5	`eq` 3, `is_not_null` 2, `in` 1	, `SearchProtocolHost.exe`, `WerMgr.exe`, `autochk.exe`, `cscript.exe`

Top indicator values (965 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`EventType`	`eq`	`start` elasticAccess Token Manipulation via Child Process elasticAPI Call from a Process with a Spoofed Parent elasticDebug Privilege Enabled by a Low Reputation Process elasticExecution via Interactive Secondary Logon elasticParent Process PID Spoofing elasticPotential Execution via Token Theft elasticPotential Parent Process PID Spoofing via MalSecLogon elasticPotential Privilege Escalation via Rogue WinRM elasticPotential Privilege Escalation via Token Impersonation elasticPrivilege Escalation via EXTENDED STARTUPINFO elasticPrivilege Escalation via Named Pipe Impersonation elasticPrivilege Escalation via SeImpersonatePrivilege elasticPrivileges Elevation via Parent Process PID Spoofing elasticProcess Created with a Duplicated Token elasticProcess Created with an Elevated Token +4 more rules	19	388
`EventType`	`eq`	`log_on` elasticExecution via Interactive Secondary Logon elasticNetworkCleartext Logon by a Suspicious Process elasticNewCredential Logon by a Suspicious Process elasticProcess Creation via Secondary Logon	4	8
`EventType`	`eq`	`end` elasticAccess Token Manipulation via Child Process elasticAPI Call from a Process with a Spoofed Parent	2	7
`EventType`	`eq`	`token_manipulation_event` elasticCredential Manipulation - Detected - Elastic Endgame elasticCredential Manipulation - Prevented - Elastic Endgame	2	2
`EventType`	`eq`	`token_protection_event` elasticPermission Theft - Detected - Elastic Endgame elasticPermission Theft - Prevented - Elastic Endgame	2	2
`EventType`	`eq`	`token_right_adjusted` elasticDebug Privilege Enabled by a Low Reputation Process elasticSeDebugPrivilege Enabled by an Unusual Microsoft Binary	2	2
`process.parent.Ext.real.pid`	`gt`	`0` elasticAPI Call from a Process with a Spoofed Parent elasticParent Process PID Spoofing elasticParent Process PID Spoofing elasticPotential Parent Process PID Spoofing via MalSecLogon elasticPotential Privilege Escalation via Rogue WinRM elasticPotential Privilege Escalation via Token Impersonation elasticPrivilege Escalation via EXTENDED STARTUPINFO elasticPrivileges Elevation via Parent Process PID Spoofing elasticSuspicious Process with a Spoofed Parent elasticUnusual Child Process Integrity Level	10	11
`IntegrityLevel`	`eq`	`S-1-16-16384` sigmaSuspicious Child Process Created as System sigmaSuspicious SYSTEM User Process Creation splunkWindows Privilege Escalation Suspicious Process Elevation splunkWindows Privilege Escalation System Process Without System Parent splunkWindows Privilege Escalation User Process Spawn System Process splunkWindows Wermgr Spawning System Integrity Process	6	31
`ParentImage`	`is_not_null`	elasticParent Process PID Spoofing elasticPotential Privilege Escalation via Token Impersonation elasticPrivilege Escalation via EXTENDED STARTUPINFO elasticPrivileges Elevation via Parent Process PID Spoofing elasticProcess Created with an Elevated Token elasticSuspicious Process with a Spoofed Parent	6	93
`Image`	`is_not_null`	elasticAPI Call from a Process with a Spoofed Parent elasticPotential Execution via Token Theft elasticProcess Creation via Secondary Logon elasticSuspicious Impersonation as Trusted Installer	4	155
`event.kind`	`eq`	`alert` elasticCredential Manipulation - Detected - Elastic Endgame elasticCredential Manipulation - Prevented - Elastic Endgame elasticPermission Theft - Detected - Elastic Endgame elasticPermission Theft - Prevented - Elastic Endgame	4	35
`event.module`	`eq`	`endgame` elasticCredential Manipulation - Detected - Elastic Endgame elasticCredential Manipulation - Prevented - Elastic Endgame elasticPermission Theft - Detected - Elastic Endgame elasticPermission Theft - Prevented - Elastic Endgame	4	15
`event.type`	`eq`	`start` elasticParent Process PID Spoofing elasticPrivilege Escalation via Named Pipe Impersonation elasticProcess Creation via Secondary Logon elasticUnusual Parent-Child Relationship	4	1036
`user.id`	`eq`	`S-1-5-18` elasticPotential Privilege Escalation via Rogue WinRM elasticPrivilege Escalation via EXTENDED STARTUPINFO elasticProcess Created with an Elevated Token elasticUnusual Privilege Escalation to System	4	6
`user.id`	`eq`	`S-1-5-18` elasticPotential Privilege Escalation via Token Impersonation elasticPrivilege Escalation via SeImpersonatePrivilege elasticPrivileges Elevation via Parent Process PID Spoofing elasticUnusual Child Process Integrity Level	4	13
`user.id`	`starts_with`	`S-1-12-*` elasticNetworkCleartext Logon by a Suspicious Process elasticNewCredential Logon by a Suspicious Process elasticProcess Creation via Secondary Logon elasticUnusual Privilege Escalation to System	4	21
`user.id`	`starts_with`	`S-1-5-21*` elasticNetworkCleartext Logon by a Suspicious Process elasticNewCredential Logon by a Suspicious Process elasticProcess Creation via Secondary Logon elasticUnusual Privilege Escalation to System	4	21
`EventID`	`eq`	`10` splunkWindows Access Token Manipulation Winlogon Duplicate Token Handle splunkWindows Access Token Winlogon Duplicate Handle In Uncommon Path splunkWindows Handle Duplication in Known UAC-Bypass Binaries	3	16
`EventID`	`eq`	`4738` splunkWindows AD Cross Domain SID History Addition splunkWindows AD Same Domain SID History Addition	2	4
`EventID`	`eq`	`4742` splunkWindows AD Cross Domain SID History Addition splunkWindows AD Same Domain SID History Addition	2	6
`EventID`	`eq`	`5136` kustoPossible Resource-Based Constrained Delegation Abuse kustoService Principal Name (SPN) Assigned to User Account	2	20
`Image`	`starts_with`	`C:\*` elasticInteractive Logon by an Unusual Process elasticNetworkCleartext Logon by a Suspicious Process elasticNewCredential Logon by a Suspicious Process	3	16
`Signature`	`starts_with`	`Microsoft*` elasticAccess Token Manipulation via Child Process elasticAPI Call from a Process with a Spoofed Parent elasticPotential Execution via Token Theft	3	19
`user`	`contains`	`AUTHORI` sigmaRedSun - Conhost.exe Spawned by TieringEngineService.exe sigmaSuspicious Child Process Created as System sigmaSuspicious SYSTEM User Process Creation	3	14
`user`	`contains`	`AUTORI` sigmaRedSun - Conhost.exe Spawned by TieringEngineService.exe sigmaSuspicious Child Process Created as System sigmaSuspicious SYSTEM User Process Creation	3	14
`user.effective.id`	`starts_with`	`S-1-12-*` elasticNetworkCleartext Logon by a Suspicious Process elasticNewCredential Logon by a Suspicious Process elasticProcess Creation via Secondary Logon	3	4
`user.effective.id`	`starts_with`	`S-1-5-21*` elasticNetworkCleartext Logon by a Suspicious Process elasticNewCredential Logon by a Suspicious Process elasticProcess Creation via Secondary Logon	3	4
`CommandLine`	`contains`	`/user:` sigmaPrivilege escalation via runas (command) splunkRunas Execution in CommandLine	2	6
`EnabledPrivilegeList`	`eq`	`SeDebugPrivilege` elasticDebug Privilege Enabled by a Low Reputation Process elasticSeDebugPrivilege Enabled by an Unusual Microsoft Binary	2	2
`GrantedAccess`	`eq`	`0x1040` splunkWindows Access Token Manipulation Winlogon Duplicate Token Handle splunkWindows Access Token Winlogon Duplicate Handle In Uncommon Path	2	2

Exclusions (927 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`process.code_signature.trusted`	`eq`	`true` elasticAccess Token Manipulation via Child Process elasticAPI Call from a Process with a Spoofed Parent elasticExecution via Interactive Secondary Logon elasticNetworkCleartext Logon by a Suspicious Process elasticNewCredential Logon by a Suspicious Process elasticParent Process PID Spoofing elasticPotential Parent Process PID Spoofing via MalSecLogon elasticPotential Privilege Escalation via Token Impersonation elasticPrivilege Escalation via EXTENDED STARTUPINFO elasticPrivilege Escalation via SeImpersonatePrivilege elasticPrivileges Elevation via Parent Process PID Spoofing elasticProcess Created with an Elevated Token elasticProcess Creation via Secondary Logon elasticSuspicious Impersonation as Trusted Installer elasticSuspicious Process with a Spoofed Parent +2 more rules	17
`Image`	`eq`	`?:\Windows\System32\WerFault.exe` elasticParent Process PID Spoofing elasticParent Process PID Spoofing elasticPotential Privilege Escalation via Rogue WinRM elasticPotential Privilege Escalation via Token Impersonation elasticPrivileges Elevation via Parent Process PID Spoofing elasticProcess Created with an Elevated Token elasticUnusual Child Process Integrity Level elasticUnusual Privilege Escalation to System	8
`Image`	`eq`	`?:\Windows\SysWOW64\WerFault.exe` elasticParent Process PID Spoofing elasticParent Process PID Spoofing elasticPotential Privilege Escalation via Token Impersonation elasticPrivileges Elevation via Parent Process PID Spoofing elasticProcess Created with an Elevated Token elasticUnusual Child Process Integrity Level elasticUnusual Privilege Escalation to System	7
`Image`	`eq`	`?:\Windows\System32\WerFaultSecure.exe` elasticParent Process PID Spoofing elasticPotential Privilege Escalation via Token Impersonation elasticPrivileges Elevation via Parent Process PID Spoofing elasticProcess Created with an Elevated Token elasticUnusual Child Process Integrity Level elasticUnusual Privilege Escalation to System	6
`Image`	`eq`	`?:\Windows\System32\Wermgr.exe` elasticPotential Privilege Escalation via Token Impersonation elasticPrivileges Elevation via Parent Process PID Spoofing elasticProcess Created with an Elevated Token elasticSuspicious Process with a Spoofed Parent elasticUnusual Child Process Integrity Level elasticUnusual Privilege Escalation to System	6
`Image`	`eq`	`?:\WINDOWS\SysWOW64\WerFaultSecure.exe` elasticParent Process PID Spoofing elasticPotential Privilege Escalation via Token Impersonation elasticPrivileges Elevation via Parent Process PID Spoofing elasticProcess Created with an Elevated Token	4
`Image`	`eq`	`?:\Windows\SoftwareDistribution\Download\Install\securityhealthsetup.exe` elasticPotential Privilege Escalation via Token Impersonation elasticPrivileges Elevation via Parent Process PID Spoofing elasticProcess Created with an Elevated Token elasticUnusual Privilege Escalation to System	4
`Image`	`eq`	`?:\Windows\System32\MpSigStub.exe` elasticParent Process PID Spoofing elasticPrivileges Elevation via Parent Process PID Spoofing elasticUnusual Child Process Integrity Level	3
`Image`	`eq`	`?:\Windows\System32\svchost.exe` elasticPotential Privilege Escalation via Rogue WinRM elasticProcess Creation via Secondary Logon elasticSuspicious Process with a Spoofed Parent	3
`process_basename`	`eq`	`PowerShell.EXE` elasticAccess Token Manipulation via Child Process elasticNewCredential Logon by a Suspicious Process elasticParent Process PID Spoofing elasticPotential Execution via Token Theft elasticPotential Privilege Escalation via Token Impersonation elasticPrivilege Escalation via EXTENDED STARTUPINFO elasticProcess Created with a Duplicated Token elasticSuspicious Process with a Spoofed Parent	8
`process_basename`	`eq`	`rundll32.exe` elasticAccess Token Manipulation via Child Process elasticPotential Parent Process PID Spoofing via MalSecLogon elasticPrivilege Escalation via EXTENDED STARTUPINFO elasticPrivilege Escalation via SeImpersonatePrivilege elasticProcess Created with a Duplicated Token elasticSuspicious Impersonation as Trusted Installer elasticUnusual Privilege Escalation to System	7
`ParentImage`	`eq`	`?:\WINDOWS\System32\svchost.exe` elasticParent Process PID Spoofing elasticPotential Parent Process PID Spoofing via MalSecLogon elasticPrivilege Escalation via EXTENDED STARTUPINFO elasticProcess Created with a Duplicated Token elasticSuspicious Process with a Spoofed Parent elasticUnusual Privilege Escalation to System	6
`ParentImage`	`eq`	`?:\Windows\System32\Utilman.exe` elasticPotential Privilege Escalation via Token Impersonation elasticPrivilege Escalation via EXTENDED STARTUPINFO elasticPrivileges Elevation via Parent Process PID Spoofing elasticProcess Created with an Elevated Token	4
`Image`	`wildcard`	`?:\Program Files (x86)\*.exe` elasticAPI Call from a Process with a Spoofed Parent elasticInteractive Logon by an Unusual Process elasticNetworkCleartext Logon by a Suspicious Process elasticPrivilege Escalation via EXTENDED STARTUPINFO elasticProcess Created with an Elevated Token	5
`Image`	`wildcard`	`?:\Program Files\*.exe` elasticAPI Call from a Process with a Spoofed Parent elasticInteractive Logon by an Unusual Process elasticNetworkCleartext Logon by a Suspicious Process elasticPrivilege Escalation via EXTENDED STARTUPINFO elasticProcess Created with an Elevated Token	5

Access Token Manipulation `T1134`

Events covered

Authoring guide

Fields filtered most (105 distinct)

Top indicator values (965 distinct)

Exclusions (927 distinct)

Rules under this technique

Sigma 22 rules

Elastic 41 rules

Splunk 15 rules

Kusto 16 rules

Panther 5 rules

Access Token Manipulation T1134

Events covered

Authoring guide

Fields filtered most (105 distinct)

Top indicator values (965 distinct)

Exclusions (927 distinct)

Rules under this technique

Sigma 22 rules

Elastic 41 rules

Splunk 15 rules

Kusto 16 rules

Panther 5 rules

Access Token Manipulation `T1134`