Blue MockingbirdG0108 ↗
Has used JuicyPotato to abuse the SeImpersonate token privilege to escalate from web application pool accounts to NT Authority\SYSTEM.1
tfMITRE ATT&CK technique
Access Token Manipulation T1134
- Tactics
- Privilege Escalation, Stealth
- Platform
- Windows
- Version
- 3.0
- Created
- 14 December 2017
- Last modified
- 12 May 2026
- Contributors
- Tom Ueltschi @c_APT_ure; Travis Smith, Tripwire; Robby Winchester, @robwinchester3; Jared Atkinson, @jaredcatkinson
Sub-techniques 535 rules across the family · 8 mapped directly to T1134 · 5 of 5 carry rules
Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
3
Threat groups64th pct
Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.19
Tools & malwareTop 18%
Tools & malware82nd percentile · 82% of ATT&CK techniques have this many tools implementing them or fewer.8
Detection rules71st pct
Detection rules71st percentile · 71% of ATT&CK techniques have this many detection rules written or fewer.Access Token Manipulation MITRE reference T1134
64th pctamong all ATT&CK techniques for number of groups
3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
FIN6G0037 ↗
Has used has used Metasploit’s named-pipe impersonation technique to escalate privileges.1
Lotus BlossomG0030 ↗
Has retrieved process tokens for processes to adjust the privileges of the launch process or other items.1
All 3 groups for this technique
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
C0017C0017 ↗
During C0017, APT41 used a ConfuserEx obfuscated BADPOTATO exploit to abuse named-pipe impersonation for local NT AUTHORITY\SYSTEM privilege escalation.1
All 1 campaigns for this technique
19 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
QilinS1242 ↗
Can use an embedded Mimikatz module for token manipulation.1
SagerunexS1210 ↗
Finds the explorer.exe process after execution and uses it to change the token of its executing thread.1
BlackCatS1068 ↗
MafaldaS1060 ↗
Can use AdjustTokenPrivileges() to elevate privileges.1
HermeticWiperS0697 ↗
Can use AdjustTokenPrivileges to grant itself privileges for debugging with SeDebugPrivilege, creating backups with SeBackupPrivilege, loading drivers with SeLoadDriverPrivilege, and shutting down a local system with SeShutdownPrivilege.12
GelsemiumS0666 ↗
Can use token manipulation to bypass UAC on Windows7 systems.1
All 19 software entries for this technique · 6 newest in this preview
Offense vs defense T1134
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 5Splunk ESCU (cumulative) · 3
first rule: 2019 Q4 · 1 of 1 campaigns plottedAccess Token Manipulation detection strategy DET0283
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavior-chain detection for T1134 Access Token Manipulation on Windows
1 platform
AN0786 · Windows
Detection of suspicious token manipulation chains: use of token-related APIs (e.g., LogonUser, DuplicateTokenEx) or commands (runas) → spawning of a new process under a different security context (e.g., SYSTEM) → mismatched parent-child process lineage or anomalies in Event Tracing for Windows (ETW) token/PPID data → abnormal lateral or privilege escalation activity.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| OS API ExecutionDC0021 | ETW:Token | token_analysis: API calls such as DuplicateTokenEx or ImpersonateLoggedOnUser |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Process AccessDC0035 | WinEventLog:Sysmon | EventCode=10 |
| Active Directory Object ModificationDC0066 | WinEventLog:Security | EventCode=5136 |
| Logon Session MetadataDC0088 | WinEventLog:Security | EventCode=4672, 4634 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Correlation time between suspicious API usage, runas, and process creation (e.g., 5–10m). |
| AllowedServiceAccounts | Whitelist of service accounts permitted to spawn SYSTEM-level processes. |
| KnownAdminTools | Legitimate administrative utilities that trigger token changes. |
| ParentProcessAnomalyThreshold | Deviation threshold for PPID mismatches detected via ETW. |
Limit permissions so that users and user groups cannot create tokens. This setting should be defined for the local system account only. GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Create a token object. Also define who can create a process level token to only the local and network service through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Replace a process level token.
Administrators should log in as a standard user but run their tools with administrator privileges using the built-in access token manipulation command runas.
An adversary must already have administrator level access on the local system to make full use of this technique; be sure to restrict users and accounts to the least privileges they require.