BlackByteG1043 ↗
Constructed a valid authentication token following Microsoft Exchange exploitation to allow for follow-on privileged command execution.1
tfMITRE ATT&CK sub-technique
Make and Impersonate Token T1134.003
sub-technique of T1134 Access Token Manipulation
- Tactics
- Privilege Escalation, Stealth
- Platform
- Windows
- Version
- 2.0
- Created
- 18 February 2020
- Last modified
- 12 May 2026
- Contributor
- Jonny Johnson
Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the LogonUser function.[1] The function will return a copy of the new session's access token and the adversary can use SetThreadToken to assign the token to a thread.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
2
Threat groups56th pct
Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.3
Tools & malware57th pct
Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.4
Detection rules60th pct
Detection rules60th percentile · 60% of ATT&CK techniques have this many detection rules written or fewer.Make and Impersonate Token MITRE reference T1134.003
56th pctamong all ATT&CK techniques for number of groups
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 2 groups for this technique
3 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
MafaldaS1060 ↗
Can create a token for a different user.1
SILENTTRINITYS0692 ↗
Can make tokens from known credentials.1
Cobalt StrikeS0154 ↗
Can make tokens from known credentials.1
All 3 software entries for this technique
Offense vs defense T1134.003
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 0
first rule: 2022 Q4Make and Impersonate Token detection strategy DET0498
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavior‑chain detection for T1134.003 Make and Impersonate Token (Windows)
1 platform
AN1375 · Windows
A process creates a brand‑new logon session/token (LogonUser*/LsaLogonUser) and then assigns/impersonates it (SetThreadToken/ImpersonateLoggedOnUser) to run actions under that freshly created security context. Chain: (1) suspicious command or script block (e.g., runas /netonly, PowerShell P/Invoke of LogonUser) → (2) ETW/API evidence of LogonUser*/SetThreadToken → (3) Security 4624 New Logon (often LogonType=9 NewCredentials or 2/3 from a non‑interactive parent) with no interactive desktop → (4) sysmon 1 process(es) executing with the new LogonId/SID different from the parent process → (5) optional privileged ops/lateral movement.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| OS API ExecutionDC0021 | etw:Microsoft-Windows-Security-Auditing | api_call: LogonUser(A|W), LsaLogonUser, SetThreadToken, ImpersonateLoggedOnUser |
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| Logon Session MetadataDC0088 | WinEventLog:Security | EventCode=4672 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Correlation window between LogonUser*/SetThreadToken and the first spawned process (default 5–10 minutes). |
| SuspiciousLogonTypes | Which 4624 LogonTypes to treat as high risk (e.g., 9 NewCredentials, 3 Network when sourced locally). |
| AllowedImpersonators | Processes/accounts legitimately creating tokens (e.g., winlogon.exe, lsass.exe, IIS worker, trusted service accounts). |
| ParentChildUserMismatch | Whether to alert on any SID/LogonId mismatch between parent/child not in allow-list. |
| IntegrityEscalationDelta | Minimum integrity level jump (e.g., Medium→High/System) to raise severity. |
Limit permissions so that users and user groups cannot create tokens. This setting should be defined for the local system account only. GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Create a token object. Also define who can create a process level token to only the local and network service through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Replace a process level token.
Administrators should log in as a standard user but run their tools with administrator privileges using the built-in access token manipulation command runas.
An adversary must already have administrator level access on the local system to make full use of this technique; be sure to restrict users and accounts to the least privileges they require.