Access Token Manipulation `T1134`

Tactics: Stealth, Privilege Escalation

Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.

Events covered

24 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 10	ProcessAccess
Sysmon	Event ID 17	PipeEvent (Pipe Created)
Sysmon	Event ID 18	PipeEvent (Pipe Connected)
Security-Auditing	Event ID 4624	An account was successfully logged on.
Security-Auditing	Event ID 4648	A logon was attempted using explicit credentials.
Security-Auditing	Event ID 4674	An operation was attempted on a privileged object.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4697	A service was installed in the system.
Security-Auditing	Event ID 4703	A user right was adjusted.
Security-Auditing	Event ID 4704	A user right was assigned.
Security-Auditing	Event ID 4717	System security access was granted to an account.
Security-Auditing	Event ID 4738	A user account was changed.
Security-Auditing	Event ID 4742	A computer account was changed.
Security-Auditing	Event ID 4765	SID History was added to an account.
Security-Auditing	Event ID 4766	An attempt to add SID History to an account failed.
Security-Auditing	Event ID 5136	A directory service object was modified.
Security-Auditing	Event ID 5447	A Windows Filtering Platform filter has been changed.
Security-Auditing	Event ID 5449	A Windows Filtering Platform provider context has been changed.
1Password-ServiceAccountToken	any	Service account token (catch-all)
Defender-DeviceLogonEvents	any	Logon activity
Defender-DeviceProcessEvents	any	Process activity
Defender-DeviceProcessEvents	ProcessCreated	Process created
Service-Control-Manager	Event ID 7045	A service was installed in the system.

Authoring guide

These 98 rules share fields, values, and exclusions.

Fields filtered most (127 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	29	`eq` 29	`start`, `log_on`, `end`, `token_manipulation_event`, `token_protection_event`
`Image`	22	`ends_with` 9, `is_not_null` 4, `starts_with` 4, `in` 2, `wildcard` 2, `contains` 1, `eq` 1	`c:\`, `\\\\`, `\\programdata\\`, `\\temp\\`, `\cmd.exe`
`CommandLine`	16	`contains` 13, `ends_with` 3, `match` 1, `regex_match` 1, `wildcard` 1	`/user:`, `-decode` , `-e* aqblahga`, `-e* awv4i`, `-spawnto`
`EventID`	15	`eq` 14, `in` 1	`10`, `4738`, `4742`, `5136`, `1`
`user.id`	15	`eq` 8, `starts_with` 6, `ne` 3, `is_not_null` 1	`S-1-5-18`, `S-1-12-`, `S-1-5-21`, `s-1-5-18`, `S-1-12-1-`
`ParentImage`	13	`is_not_null` 6, `ends_with` 3, `in` 2, `contains` 1, `regex_match` 1, `starts_with` 1	`\\\\`, `\\programdata\\`, `\\temp\\`, `(c:\\windows\\system32\\[a-z0-9\-\_\.]+\.exe\|c:\\windows\...`, `:\packages\plugins\microsoft.guestconfiguration.configura...`
`process.parent.Ext.real.pid`	11	`gt` 10, `is_null` 1	`0`
`process_name`	11	`eq` 6, `in` 3, `ends_with` 1, `starts_with` 1	`cmd.exe`, `certutil.exe`, `msbuild.exe`, `powershell.exe`, `\svchost.exe`
`OriginalFileName`	9	`eq` 6, `in` 2, `contains` 1	`cmd.exe`, `powershell.exe`, `advancedrun.exe`, `browsercore.exe`, `cmstp.exe`
`host.os.type`	9	`eq` 9
`event.category`	7	`eq` 7	`iam`, `authentication`, `process`
`Channel`	5	`eq` 5, `in` 5
`Hashes`	5	`contains` 2, `ne` 2, `is_not_null` 1	`8ba8760bcb924e1e7943c3008a80006b29737808cc41a93cabcfeaaec9785276`, `9e23e07e042943e1862b86d8c9dc05483a118938f5b19f359cb8f9aa6a14a452`, `imphash=04d974875bd225f00902b4cad9af3fbc`, `imphash=0a358ffc1697b7a07d0e817ac740df62`, `imphash=89059503d7fbf470e68f7e63313da3ad`
`IntegrityLevel`	5	`eq` 5, `in` 2	`System`, `High`, `Low`, `Medium`
`LogonProcessName`	5	`starts_with` 3, `eq` 2	`Advapi`, `seclogo`, `advapi`

Top indicator values (996 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`EventType`	`eq`	`start` elasticAccess Token Manipulation via Child Process elasticAPI Call from a Process with a Spoofed Parent elasticDebug Privilege Enabled by a Low Reputation Process elasticExecution via Interactive Secondary Logon elasticParent Process PID Spoofing elasticPotential Execution via Token Theft elasticPotential Parent Process PID Spoofing via MalSecLogon elasticPotential Privilege Escalation via Rogue WinRM elasticPotential Privilege Escalation via Token Impersonation elasticPrivilege Escalation via EXTENDED STARTUPINFO elasticPrivilege Escalation via Named Pipe Impersonation elasticPrivilege Escalation via SeImpersonatePrivilege elasticPrivileges Elevation via Parent Process PID Spoofing elasticProcess Created with a Duplicated Token elasticProcess Created with an Elevated Token +4 more rules	19	391
`EventType`	`eq`	`log_on` elasticExecution via Interactive Secondary Logon elasticNetworkCleartext Logon by a Suspicious Process elasticNewCredential Logon by a Suspicious Process elasticProcess Creation via Secondary Logon	4	8
`EventType`	`eq`	`end` elasticAccess Token Manipulation via Child Process elasticAPI Call from a Process with a Spoofed Parent	2	18
`EventType`	`eq`	`token_manipulation_event` elasticCredential Manipulation - Detected - Elastic Endgame elasticCredential Manipulation - Prevented - Elastic Endgame	2	2
`EventType`	`eq`	`token_protection_event` elasticPermission Theft - Detected - Elastic Endgame elasticPermission Theft - Prevented - Elastic Endgame	2	2
`EventType`	`eq`	`token_right_adjusted` elasticDebug Privilege Enabled by a Low Reputation Process elasticSeDebugPrivilege Enabled by an Unusual Microsoft Binary	2	2
`process.parent.Ext.real.pid`	`gt`	`0` elasticAPI Call from a Process with a Spoofed Parent elasticParent Process PID Spoofing elasticParent Process PID Spoofing elasticPotential Parent Process PID Spoofing via MalSecLogon elasticPotential Privilege Escalation via Rogue WinRM elasticPotential Privilege Escalation via Token Impersonation elasticPrivilege Escalation via EXTENDED STARTUPINFO elasticPrivileges Elevation via Parent Process PID Spoofing elasticSuspicious Process with a Spoofed Parent elasticUnusual Child Process Integrity Level	10	11
`IntegrityLevel`	`eq`	`System` sigmaSuspicious Child Process Created as System sigmaSuspicious SYSTEM User Process Creation splunkWindows Privilege Escalation Suspicious Process Elevation splunkWindows Privilege Escalation System Process Without System Parent splunkWindows Privilege Escalation User Process Spawn System Process	5	30
`event.kind`	`eq`	`alert` elasticCredential Manipulation - Detected - Elastic Endgame elasticCredential Manipulation - Prevented - Elastic Endgame elasticPermission Theft - Detected - Elastic Endgame elasticPermission Theft - Prevented - Elastic Endgame	4	38
`event.module`	`eq`	`endgame` elasticCredential Manipulation - Detected - Elastic Endgame elasticCredential Manipulation - Prevented - Elastic Endgame elasticPermission Theft - Detected - Elastic Endgame elasticPermission Theft - Prevented - Elastic Endgame	4	15
`event.type`	`eq`	`start` elasticParent Process PID Spoofing elasticPrivilege Escalation via Named Pipe Impersonation elasticProcess Creation via Secondary Logon elasticUnusual Parent-Child Relationship	4	1078
`user.id`	`eq`	`S-1-5-18` elasticPotential Privilege Escalation via Rogue WinRM elasticPrivilege Escalation via EXTENDED STARTUPINFO elasticProcess Created with an Elevated Token elasticUnusual Privilege Escalation to System	4	6
`user.id`	`eq`	`s-1-5-18` elasticPotential Privilege Escalation via Token Impersonation elasticPrivilege Escalation via SeImpersonatePrivilege elasticPrivileges Elevation via Parent Process PID Spoofing elasticUnusual Child Process Integrity Level	4	13
`user.id`	`starts_with`	`S-1-12-` elasticNetworkCleartext Logon by a Suspicious Process elasticNewCredential Logon by a Suspicious Process elasticProcess Creation via Secondary Logon elasticUnusual Privilege Escalation to System	4	46
`user.id`	`starts_with`	`S-1-5-21` elasticNetworkCleartext Logon by a Suspicious Process elasticNewCredential Logon by a Suspicious Process elasticProcess Creation via Secondary Logon elasticUnusual Privilege Escalation to System	4	47
`EventID`	`eq`	`10` splunkWindows Access Token Manipulation Winlogon Duplicate Token Handle splunkWindows Access Token Winlogon Duplicate Handle In Uncommon Path splunkWindows Handle Duplication in Known UAC-Bypass Binaries	3	23
`EventID`	`eq`	`5136` splunkWindows AD SID History Attribute Modified kustoPossible Resource-Based Constrained Delegation Abuse kustoService Principal Name (SPN) Assigned to User Account	3	45
`EventID`	`eq`	`4738` splunkWindows AD Cross Domain SID History Addition splunkWindows AD Same Domain SID History Addition	2	8
`EventID`	`eq`	`4742` splunkWindows AD Cross Domain SID History Addition splunkWindows AD Same Domain SID History Addition	2	6
`Image`	`starts_with`	`c:\` elasticInteractive Logon by an Unusual Process elasticNetworkCleartext Logon by a Suspicious Process elasticNewCredential Logon by a Suspicious Process	3	16
`Signature`	`starts_with`	`Microsoft` elasticAccess Token Manipulation via Child Process elasticAPI Call from a Process with a Spoofed Parent elasticPotential Execution via Token Theft	3	22
`event.category`	`eq`	`iam` elasticDebug Privilege Enabled by a Low Reputation Process elasticSeDebugPrivilege Enabled by an Unusual Microsoft Binary elasticSuspicious SeIncreaseBasePriorityPrivilege Use	3	8
`event.outcome`	`eq`	`success` elasticGKE API Request Impersonating Privileged Identity elasticProcess Creation via Secondary Logon elasticSuspicious SeIncreaseBasePriorityPrivilege Use	3	369
`src_ip`	`eq`	`::1` sigmaPotentially Suspicious Explicit Credential Local Logon sigmaPrivilege escalation via runas (command) elasticProcess Creation via Secondary Logon	3	7
`user`	`contains`	`authori` sigmaRedSun - Conhost.exe Spawned by TieringEngineService.exe sigmaSuspicious Child Process Created as System sigmaSuspicious SYSTEM User Process Creation	3	14
`user`	`contains`	`autori` sigmaRedSun - Conhost.exe Spawned by TieringEngineService.exe sigmaSuspicious Child Process Created as System sigmaSuspicious SYSTEM User Process Creation	3	14
`user.effective.id`	`starts_with`	`S-1-12-` elasticNetworkCleartext Logon by a Suspicious Process elasticNewCredential Logon by a Suspicious Process elasticProcess Creation via Secondary Logon	3	4
`user.effective.id`	`starts_with`	`S-1-5-21` elasticNetworkCleartext Logon by a Suspicious Process elasticNewCredential Logon by a Suspicious Process elasticProcess Creation via Secondary Logon	3	4
`CommandLine`	`contains`	`/user:` sigmaPrivilege escalation via runas (command) splunkRunas Execution in CommandLine	2	7
`EnabledPrivilegeList`	`eq`	`SeDebugPrivilege` elasticDebug Privilege Enabled by a Low Reputation Process elasticSeDebugPrivilege Enabled by an Unusual Microsoft Binary	2	2

Exclusions (922 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`process.code_signature.trusted`	`eq`	`true` elasticAccess Token Manipulation via Child Process elasticAPI Call from a Process with a Spoofed Parent elasticExecution via Interactive Secondary Logon elasticNetworkCleartext Logon by a Suspicious Process elasticNewCredential Logon by a Suspicious Process elasticParent Process PID Spoofing elasticPotential Parent Process PID Spoofing via MalSecLogon elasticPotential Privilege Escalation via Token Impersonation elasticPrivilege Escalation via EXTENDED STARTUPINFO elasticPrivilege Escalation via SeImpersonatePrivilege elasticPrivileges Elevation via Parent Process PID Spoofing elasticProcess Created with an Elevated Token elasticProcess Creation via Secondary Logon elasticSuspicious Impersonation as Trusted Installer elasticSuspicious Process with a Spoofed Parent +2 more rules	17
`process_name`	`eq`	`rundll32.exe` elasticAccess Token Manipulation via Child Process elasticExecution via Interactive Secondary Logon elasticPotential Parent Process PID Spoofing via MalSecLogon elasticPrivilege Escalation via EXTENDED STARTUPINFO elasticPrivilege Escalation via SeImpersonatePrivilege elasticProcess Created with a Duplicated Token elasticProcess Creation via Secondary Logon elasticSuspicious Impersonation as Trusted Installer elasticUnusual Privilege Escalation to System	9
`process_name`	`eq`	`powershell.exe` elasticAccess Token Manipulation via Child Process elasticNewCredential Logon by a Suspicious Process elasticParent Process PID Spoofing elasticPotential Execution via Token Theft elasticPotential Privilege Escalation via Token Impersonation elasticPrivilege Escalation via EXTENDED STARTUPINFO elasticProcess Created with a Duplicated Token elasticSuspicious Process with a Spoofed Parent	8
`Image`	`eq`	`?:\windows\system32\werfault.exe` elasticParent Process PID Spoofing elasticParent Process PID Spoofing elasticPotential Privilege Escalation via Rogue WinRM elasticPotential Privilege Escalation via Token Impersonation elasticPrivileges Elevation via Parent Process PID Spoofing elasticProcess Created with an Elevated Token elasticUnusual Child Process Integrity Level elasticUnusual Privilege Escalation to System	8
`Image`	`eq`	`?:\windows\syswow64\werfault.exe` elasticParent Process PID Spoofing elasticParent Process PID Spoofing elasticPotential Privilege Escalation via Token Impersonation elasticPrivileges Elevation via Parent Process PID Spoofing elasticProcess Created with an Elevated Token elasticUnusual Child Process Integrity Level elasticUnusual Privilege Escalation to System	7
`Image`	`eq`	`?:\windows\system32\werfaultsecure.exe` elasticParent Process PID Spoofing elasticPotential Privilege Escalation via Token Impersonation elasticPrivileges Elevation via Parent Process PID Spoofing elasticProcess Created with an Elevated Token elasticUnusual Child Process Integrity Level elasticUnusual Privilege Escalation to System	6
`Image`	`eq`	`?:\windows\system32\wermgr.exe` elasticPotential Privilege Escalation via Token Impersonation elasticPrivileges Elevation via Parent Process PID Spoofing elasticProcess Created with an Elevated Token elasticSuspicious Process with a Spoofed Parent elasticUnusual Child Process Integrity Level elasticUnusual Privilege Escalation to System	6
`Image`	`eq`	`?:\windows\softwaredistribution\download\install\securityhealthsetup.exe` elasticPotential Privilege Escalation via Token Impersonation elasticPrivileges Elevation via Parent Process PID Spoofing elasticProcess Created with an Elevated Token elasticUnusual Privilege Escalation to System	4
`Image`	`eq`	`?:\windows\syswow64\werfaultsecure.exe` elasticParent Process PID Spoofing elasticPotential Privilege Escalation via Token Impersonation elasticPrivileges Elevation via Parent Process PID Spoofing elasticProcess Created with an Elevated Token	4
`Image`	`eq`	`?:\windows\system32\mpsigstub.exe` elasticParent Process PID Spoofing elasticPrivileges Elevation via Parent Process PID Spoofing elasticUnusual Child Process Integrity Level	3
`Image`	`eq`	`?:\windows\system32\svchost.exe` elasticPotential Privilege Escalation via Rogue WinRM elasticProcess Creation via Secondary Logon elasticSuspicious Process with a Spoofed Parent	3
`ParentImage`	`eq`	`?:\windows\system32\svchost.exe` elasticParent Process PID Spoofing elasticPotential Parent Process PID Spoofing via MalSecLogon elasticPrivilege Escalation via EXTENDED STARTUPINFO elasticProcess Created with a Duplicated Token elasticSuspicious Process with a Spoofed Parent elasticUnusual Privilege Escalation to System	6
`ParentImage`	`eq`	`?:\windows\system32\utilman.exe` elasticPotential Privilege Escalation via Token Impersonation elasticPrivilege Escalation via EXTENDED STARTUPINFO elasticPrivileges Elevation via Parent Process PID Spoofing elasticProcess Created with an Elevated Token	4
`Image`	`wildcard`	`?:\program files (x86)\*.exe` elasticAPI Call from a Process with a Spoofed Parent elasticInteractive Logon by an Unusual Process elasticNetworkCleartext Logon by a Suspicious Process elasticPrivilege Escalation via EXTENDED STARTUPINFO elasticProcess Created with an Elevated Token	5
`Image`	`wildcard`	`?:\program files\*.exe` elasticAPI Call from a Process with a Spoofed Parent elasticInteractive Logon by an Unusual Process elasticNetworkCleartext Logon by a Suspicious Process elasticPrivilege Escalation via EXTENDED STARTUPINFO elasticProcess Created with an Elevated Token	5

Access Token Manipulation `T1134`

Events covered

Authoring guide

Fields filtered most (127 distinct)

Top indicator values (996 distinct)

Exclusions (922 distinct)

Rules under this technique

Sigma 22 rules

Elastic 41 rules

Splunk 14 rules

Kusto 16 rules

Panther 5 rules

Access Token Manipulation T1134

Events covered

Authoring guide

Fields filtered most (127 distinct)

Top indicator values (996 distinct)

Exclusions (922 distinct)

Rules under this technique

Sigma 22 rules

Elastic 41 rules

Splunk 14 rules

Kusto 16 rules

Panther 5 rules

Access Token Manipulation `T1134`