tfMITRE ATT&CK technique

Access Token Manipulation T1134

Tactics: Privilege Escalation, Stealth
Platform: Windows
Version: 3.0
Created: 14 December 2017
Last modified: 12 May 2026
Contributors: Tom Ueltschi @c_APT_ure; Travis Smith, Tripwire; Robby Winchester, @robwinchester3; Jared Atkinson, @jaredcatkinson

Sub-techniques 535 rules across the family · 8 mapped directly to T1134 · 5 of 5 carry rules

.001Token Impersonation/Theft15 .002Create Process with Token10 .003Make and Impersonate Token4 .004Parent PID Spoofing3 .005SID-History Injection5

Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 56% of ATT&CK techniques have fewer threat groups attributed.

Campaigns72nd pct

Campaigns72nd percentile · 54% of ATT&CK techniques have fewer campaigns recorded.

Tools & malwareTop 18%

Tools & malware82nd percentile · 81% of ATT&CK techniques have fewer tools implementing them.

Detection rules72nd pct

Detection rules72nd percentile · 69% of ATT&CK techniques have fewer detection rules written.

tfMITRE ATT&CK technique

Access Token Manipulation T1134

Tactics: Privilege Escalation, Stealth
Platform: Windows
Version: 3.0
Created: 14 December 2017
Last modified: 12 May 2026
Contributors: Tom Ueltschi @c_APT_ure; Travis Smith, Tripwire; Robby Winchester, @robwinchester3; Jared Atkinson, @jaredcatkinson

Sub-techniques 535 rules across the family · 8 mapped directly to T1134 · 5 of 5 carry rules

.001Token Impersonation/Theft15 .002Create Process with Token10 .003Make and Impersonate Token4 .004Parent PID Spoofing3 .005SID-History Injection5

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 56% of ATT&CK techniques have fewer threat groups attributed.

Campaigns72nd pct

Campaigns72nd percentile · 54% of ATT&CK techniques have fewer campaigns recorded.

Tools & malwareTop 18%

Tools & malware82nd percentile · 81% of ATT&CK techniques have fewer tools implementing them.

Detection rules72nd pct

Detection rules72nd percentile · 69% of ATT&CK techniques have fewer detection rules written.

Access Token Manipulation MITRE reference T1134

64th pctamong all ATT&CK techniques for number of groups

3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Blue MockingbirdG0108 ↗

Has used JuicyPotato to abuse the SeImpersonate token privilege to escalate from web application pool accounts to NT Authority\SYSTEM.1

created 2020-05-261 reference

FIN6G0037 ↗

Has used has used Metasploit’s named-pipe impersonation technique to escalate privileges.1

created 2017-05-311 referenceaka Magecart Group 6

Lotus BlossomG0030 ↗

Has retrieved process tokens for processes to adjust the privileges of the launch process or other items.1

created 2017-05-311 referenceaka DRAGONFISH

All 3 groups for this technique

1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

C0017C0017 ↗

During C0017, APT41 used a ConfuserEx obfuscated BADPOTATO exploit to abuse named-pipe impersonation for local NT AUTHORITY\SYSTEM privilege escalation.1

2021–2022

All 1 campaigns for this technique

19 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

QilinS1242 ↗

Can use an embedded Mimikatz module for token manipulation.1

created 2025-09-26MALWAREcarried by 2 groups

SagerunexS1210 ↗

Finds the explorer.exe process after execution and uses it to change the token of its executing thread.1

created 2025-03-15MALWAREcarried by 1 group

BlackCatS1068 ↗

Has the ability modify access tokens.1 2

created 2023-02-28MALWAREcarried by 1 group

MafaldaS1060 ↗

Can use AdjustTokenPrivileges() to elevate privileges.1

created 2023-01-26MALWAREcarried by 1 group

HermeticWiperS0697 ↗

Can use AdjustTokenPrivileges to grant itself privileges for debugging with SeDebugPrivilege, creating backups with SeBackupPrivilege, loading drivers with SeLoadDriverPrivilege, and shutting down a local system with SeShutdownPrivilege.1 2

created 2022-03-25MALWARE

GelsemiumS0666 ↗

Can use token manipulation to bypass UAC on Windows7 systems.1

created 2021-11-30MALWARE

All 19 software entries for this technique · 6 newest in this preview

Data component	Name	Channel
OS API ExecutionDC0021	ETW:Token	token_analysis: API calls such as DuplicateTokenEx or ImpersonateLoggedOnUser
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10
Active Directory Object ModificationDC0066	WinEventLog:Security	EventCode=5136
Logon Session MetadataDC0088	WinEventLog:Security	EventCode=4672, 4634

Data component

Name

Channel

OS API ExecutionDC0021

ETW:Token

token_analysis: API calls such as DuplicateTokenEx or ImpersonateLoggedOnUser

Process CreationDC0032

WinEventLog:Sysmon

EventCode=1

Process AccessDC0035

WinEventLog:Sysmon

EventCode=10

Active Directory Object ModificationDC0066

WinEventLog:Security

EventCode=5136

Logon Session MetadataDC0088

WinEventLog:Security

EventCode=4672, 4634

Field	What you tune
TimeWindow	Correlation time between suspicious API usage, runas, and process creation (e.g., 5–10m).
AllowedServiceAccounts	Whitelist of service accounts permitted to spawn SYSTEM-level processes.
KnownAdminTools	Legitimate administrative utilities that trigger token changes.
ParentProcessAnomalyThreshold	Deviation threshold for PPID mismatches detected via ETW.

Field

What you tune

TimeWindow

Correlation time between suspicious API usage, runas, and process creation (e.g., 5–10m).

AllowedServiceAccounts

Whitelist of service accounts permitted to spawn SYSTEM-level processes.

KnownAdminTools

Legitimate administrative utilities that trigger token changes.

ParentProcessAnomalyThreshold

Deviation threshold for PPID mismatches detected via ETW.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK (...)	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation, Stealth Access Token Manipulation Create Process with Token	-	high	Teymur Kheirkhabarov	2019-10-26	2020-09-01	6c5808ee-85a2-4e56-8137-72e5876a5096
	Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escal (...)	Generic	test	-	windows	WinEventLog Security	Privilege Escalation, Stealth Access Token Manipulation Token Impersonation/Theft	-	high	Stamatis Chatzimangou (st0pp3r)	2024-01-05	—	7b14c76a-c602-4ae6-9717-eff868153fc0
	Detects potentially suspicious explicit credential logon events where the user is trying to logon wi (...)	Generic	experimental	authentication	windows	WinEventLog Security	Privilege Escalation, Stealth Access Token Manipulation Make and Impersonate Token	-	medium	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-07-23	—	e3c6d245-7b8f-4e2a-c17f-a9d0e5b38f62
	Detects suspicious spawning of a process under a different user context than the parent process. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation, Stealth Access Token Manipulation Privilege Escalation, Stealth Process Injection	-	medium	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-07-23	—	d2b7a134-9c3e-4f8a-b56d-e0c1f8a29b47
	Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation, Stealth Access Token Manipulation Stealth Obfuscated Files or Information Credential Access OS Credential Dumping	-	high	Florian Roth (Nextron Systems), David ANDRE (additional keywords)	2021-12-20	2025-10-19	2617e7ed-adb7-40ba-b0f3-8f9945fe6c09
Splunk	The following analytic detects when a process running with low or medium integrity from a user account spawns an elevated process with high or system integrity in suspicious locations. (...)	Generic	stable	process_creation	windows	Sysmon	Privilege Escalation Abuse Elevation Control Mechanism Privilege Escalation, Stealth Access Token Manipulation Privilege Escalation Exploitation for Privilege Escalation	-	medium	Steven Dick	2024-02-14	2026-05-13	6a80300a-9f8a-4f22-bd3e-09ca577cfdfc
Splunk	The following analytic detects any system integrity level process spawned by a non-system account. (...)	Generic	stable	process_creation	windows	Sysmon	Privilege Escalation Abuse Elevation Control Mechanism Privilege Escalation, Stealth Access Token Manipulation Privilege Escalation Exploitation for Privilege Escalation	-	medium	Steven Dick	2024-02-14	2026-05-13	5a5351cd-ba7e-499e-ad82-2ce160ffa637
Splunk	The following analytic detects when a process with low, medium, or high integrity spawns a system integrity process from a user-controlled location. (...)	Generic	stable	process_creation	windows	Sysmon	Privilege Escalation Abuse Elevation Control Mechanism Privilege Escalation, Stealth Access Token Manipulation Privilege Escalation Exploitation for Privilege Escalation	-	medium	Steven Dick	2024-02-14	2026-05-13	c9687a28-39ad-43c6-8bcf-eaf061ba0cbe

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK (...)	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation, Stealth Access Token Manipulation Create Process with Token	-	high	Teymur Kheirkhabarov	2019-10-26	2020-09-01	6c5808ee-85a2-4e56-8137-72e5876a5096
	Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escal (...)	Generic	test	-	windows	WinEventLog Security	Privilege Escalation, Stealth Access Token Manipulation Token Impersonation/Theft	-	high	Stamatis Chatzimangou (st0pp3r)	2024-01-05	—	7b14c76a-c602-4ae6-9717-eff868153fc0
	Detects potentially suspicious explicit credential logon events where the user is trying to logon wi (...)	Generic	experimental	authentication	windows	WinEventLog Security	Privilege Escalation, Stealth Access Token Manipulation Make and Impersonate Token	-	medium	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-07-23	—	e3c6d245-7b8f-4e2a-c17f-a9d0e5b38f62
	Detects suspicious spawning of a process under a different user context than the parent process. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation, Stealth Access Token Manipulation Privilege Escalation, Stealth Process Injection	-	medium	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-07-23	—	d2b7a134-9c3e-4f8a-b56d-e0c1f8a29b47
	Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation, Stealth Access Token Manipulation Stealth Obfuscated Files or Information Credential Access OS Credential Dumping	-	high	Florian Roth (Nextron Systems), David ANDRE (additional keywords)	2021-12-20	2025-10-19	2617e7ed-adb7-40ba-b0f3-8f9945fe6c09
Splunk	The following analytic detects when a process running with low or medium integrity from a user account spawns an elevated process with high or system integrity in suspicious locations. (...)	Generic	stable	process_creation	windows	Sysmon	Privilege Escalation Abuse Elevation Control Mechanism Privilege Escalation, Stealth Access Token Manipulation Privilege Escalation Exploitation for Privilege Escalation	-	medium	Steven Dick	2024-02-14	2026-05-13	6a80300a-9f8a-4f22-bd3e-09ca577cfdfc
Splunk	The following analytic detects any system integrity level process spawned by a non-system account. (...)	Generic	stable	process_creation	windows	Sysmon	Privilege Escalation Abuse Elevation Control Mechanism Privilege Escalation, Stealth Access Token Manipulation Privilege Escalation Exploitation for Privilege Escalation	-	medium	Steven Dick	2024-02-14	2026-05-13	5a5351cd-ba7e-499e-ad82-2ce160ffa637
Splunk	The following analytic detects when a process with low, medium, or high integrity spawns a system integrity process from a user-controlled location. (...)	Generic	stable	process_creation	windows	Sysmon	Privilege Escalation Abuse Elevation Control Mechanism Privilege Escalation, Stealth Access Token Manipulation Privilege Escalation Exploitation for Privilege Escalation	-	medium	Steven Dick	2024-02-14	2026-05-13	c9687a28-39ad-43c6-8bcf-eaf061ba0cbe

Access Token Manipulation T1134

Access Token Manipulation T1134

Access Token Manipulation MITRE reference T1134

Access Token Manipulation MITRE reference T1134

Offense vs defense T1134

Access Token Manipulation detection strategy DET0283

Behavior-chain detection for T1134 Access Token Manipulation on Windows

Log sources

Tunable fields

Access Token Manipulation detections T1134

Access Token Manipulation detections T1134