TA0004 · PRIVILEGE ESCALATION
Access Token Manipulation
Stealing or impersonating another process's token to inherit its privileges.
Detect it with
Process access with high-privilege rights (0x1410) against SYSTEM processes; SeDebugPrivilege use by unexpected binaries.
Why it matters on shift
Access Token Manipulation is one of the concrete ways adversaries achieve privilege escalation. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After privilege escalation, the next tactic is usually Defense Evasion. Search your telemetry for the transition before closing the ticket.
5 sub-techniques
How it shows up in practice
- T1134.001
Token Impersonation/Theft
Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using DuplicateToken or DuplicateTokenEx.
- T1134.002
Create Process with Token
Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as CreateProcessWithTokenW and runas .
- T1134.003
Make and Impersonate Token
Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls.
- T1134.004
Parent PID Spoofing
Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. New processes are typically spawned directly from their parent, or calling, process unless explicitly specified.
- T1134.005
SID-History Injection
Adversaries may use SID-History Injection to escalate privileges and bypass access controls. The Windows security identifier (SID) is a unique value that identifies a user or group account.
Kill-chain context