| ID | Name |
|---|---|
| T1134.001 | Token Impersonation/Theft |
| T1134.002 | Create Process with Token |
| T1134.003 | Make and Impersonate Token |
| T1134.004 | Parent PID Spoofing |
| T1134.005 | SID-History Injection |
Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using DuplicateToken or DuplicateTokenEx.[1] The token can then be used with ImpersonateLoggedOnUser to allow the calling thread to impersonate a logged on user's security context, or with SetThreadToken to assign the impersonated token to a thread.
An adversary may perform Token Impersonation/Theft when they have a specific, existing process they want to assign the duplicated token to. For example, this may be useful for when the target user has a non-network logon session on the system.
When an adversary would instead use a duplicated token to create a new process rather than attaching to an existing process, they can additionally Create Process with Token using CreateProcessWithTokenW or CreateProcessAsUserW. Token Impersonation/Theft is also distinct from Make and Impersonate Token in that it refers to duplicating an existing token, rather than creating a new one.
| ID | Name | Description |
|---|---|---|
| G0007 | APT28 |
APT28 has used CVE-2015-1701 to access the SYSTEM token and copy it into the current process as part of privilege escalation.[2] |
| S0456 | Aria-body |
Aria-body has the ability to duplicate a token from ntprint.exe.[3] |
| S1081 | BADHATCH |
BADHATCH can impersonate a |
| S0570 | BitPaymer |
BitPaymer can use the tokens of users to create processes on infected systems.[5] |
| S0154 | Cobalt Strike |
Cobalt Strike can steal access tokens from exiting processes.[6][7] |
| S0367 | Emotet |
Emotet has the ability to duplicate the user’s token.[8] For example, Emotet may use a variant of Google’s ProtoBuf to send messages that specify how code will be executed.[9] |
| G0061 | FIN8 |
FIN8 has used a malicious framework designed to impersonate the lsass.exe/vmtoolsd.exe token.[10][11] |
| S0182 | FinFisher |
FinFisher uses token manipulation with NtFilterToken as part of UAC bypass.[12][13] |
| C0038 | HomeLand Justice |
During HomeLand Justice, threat actors used custom tooling to acquire tokens using |
| S0439 | Okrum |
Okrum can impersonate a logged-on user's security context using a call to the ImpersonateLoggedOnUser API.[15] |
| S0192 | Pupy |
Pupy can obtain a list of SIDs and provide the option for selecting process tokens to impersonate.[16] |
| S0496 | REvil |
REvil can obtain the token from the user that launched the explorer.exe process to avoid affecting the desktop of the SYSTEM user.[17] |
| S0140 | Shamoon |
Shamoon can impersonate tokens using |
| S0692 | SILENTTRINITY |
SILENTTRINITY can find a process owned by a specific user and impersonate the associated token.[19] |
| S0623 | Siloscape |
Siloscape impersonates the main thread of |
| S0603 | Stuxnet |
Stuxnet attempts to impersonate an anonymous token to enumerate bindings in the service control manager.[21] |
| S1011 | Tarrask |
Tarrask leverages token theft to obtain |
| ID | Mitigation | Description |
|---|---|---|
| M1026 | Privileged Account Management |
Limit permissions so that users and user groups cannot create tokens. This setting should be defined for the local system account only. GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Create a token object. [23] Also define who can create a process level token to only the local and network service through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Replace a process level token.[24] Administrators should log in as a standard user but run their tools with administrator privileges using the built-in access token manipulation command |
| M1018 | User Account Management |
An adversary must already have administrator level access on the local system to make full use of this technique; be sure to restrict users and accounts to the least privileges they require. |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0017 | Command | Command Execution |
Monitor executed commands and arguments to detect token manipulation by auditing command-line activity. Specifically, analysts should look for use of the runas command. Detailed command-line logging is not enabled by default in Windows.[26] |
| DS0009 | Process | OS API Execution |
Monitor for API calls associated with other suspicious behavior to reduce false positives that may be due to normal benign use by users and administrators, such as DuplicateToken(Ex), ImpersonateLoggedOnUser , and SetThreadToken. |