T1134: Access Token Manipulation

Description

Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.

An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. These token can then be applied to an existing process (i.e. Token Impersonation/Theft) or used to spawn a new process (i.e. Create Process with Token). An adversary must already be in a privileged user context (i.e. administrator) to steal a token. However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level. An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.(Citation: Pentestlab Token Manipulation)

Any standard user can use the runas command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account. There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens.

Platforms

Sub-Techniques (5)

Mitigations (2)

Threat Groups (3)

ID	Group	Context
G0030	Lotus Blossom	[Lotus Blossom](https://attack.mitre.org/groups/G0030) has retrieved process tokens for processes to adjust the privileges of the launch process or ot...
G0037	FIN6	[FIN6](https://attack.mitre.org/groups/G0037) has used has used Metasploit’s named-pipe impersonation technique to escalate privileges.(Citation: Fire...
G0108	Blue Mockingbird	[Blue Mockingbird](https://attack.mitre.org/groups/G0108) has used JuicyPotato to abuse the <code>SeImpersonate</code> token privilege to escalate fro...

Associated Software (19)

ID	Name	Type	Context
S1242	Qilin	Malware	[Qilin](https://attack.mitre.org/software/S1242) can use an embedded [Mimikatz](https://attack.mitre.org/software/S0002) module for token manipulation...
S0697	HermeticWiper	Malware	[HermeticWiper](https://attack.mitre.org/software/S0697) can use `AdjustTokenPrivileges` to grant itself privileges for debugging with `SeDebugPrivile...
S0562	SUNSPOT	Malware	[SUNSPOT](https://attack.mitre.org/software/S0562) modified its security token to grants itself debugging privileges by adding <code>SeDebugPrivilege<...
S0194	PowerSploit	Tool	[PowerSploit](https://attack.mitre.org/software/S0194)'s <code>Invoke-TokenManipulation</code> Exfiltration module can be used to manipulate tokens.(C...
S0622	AppleSeed	Malware	[AppleSeed](https://attack.mitre.org/software/S0622) can gain system level privilege by passing <code>SeDebugPrivilege</code> to the <code>AdjustToken...
S0633	Sliver	Tool	[Sliver](https://attack.mitre.org/software/S0633) has the ability to manipulate user tokens on targeted Windows systems.(Citation: Bishop Fox Sliver F...
S1210	Sagerunex	Malware	[Sagerunex](https://attack.mitre.org/software/S1210) finds the `explorer.exe` process after execution and uses it to change the token of its executing...
S0058	SslMM	Malware	[SslMM](https://attack.mitre.org/software/S0058) contains a feature to manipulate process privileges and tokens.(Citation: Baumgartner Naikon 2015)
S0038	Duqu	Malware	[Duqu](https://attack.mitre.org/software/S0038) examines running system processes for tokens that have specific system privileges. If it finds one, it...
S0363	Empire	Tool	[Empire](https://attack.mitre.org/software/S0363) can use [PowerSploit](https://attack.mitre.org/software/S0194)'s <code>Invoke-TokenManipulation</cod...
S0666	Gelsemium	Malware	[Gelsemium](https://attack.mitre.org/software/S0666) can use token manipulation to bypass UAC on Windows7 systems.(Citation: ESET Gelsemium June 2021)
S0625	Cuba	Malware	[Cuba](https://attack.mitre.org/software/S0625) has used <code>SeDebugPrivilege</code> and <code>AdjustTokenPrivileges</code> to elevate privileges.(C...
S1060	Mafalda	Malware	[Mafalda](https://attack.mitre.org/software/S1060) can use `AdjustTokenPrivileges()` to elevate privileges.(Citation: SentinelLabs Metador Technical A...
S0378	PoshC2	Tool	[PoshC2](https://attack.mitre.org/software/S0378) can use Invoke-TokenManipulation for manipulating tokens.(Citation: GitHub PoshC2)
S0203	Hydraq	Malware	[Hydraq](https://attack.mitre.org/software/S0203) creates a backdoor through which remote attackers can adjust token privileges.(Citation: Symantec Hy...
S0607	KillDisk	Malware	[KillDisk](https://attack.mitre.org/software/S0607) has attempted to get the access token of a process by calling <code>OpenProcessToken</code>. If [K...
S0446	Ryuk	Malware	[Ryuk](https://attack.mitre.org/software/S0446) has attempted to adjust its token privileges to have the <code>SeDebugPrivilege</code>.(Citation: Crow...
S0576	MegaCortex	Malware	[MegaCortex](https://attack.mitre.org/software/S0576) can enable <code>SeDebugPrivilege</code> and adjust token privileges.(Citation: IBM MegaCortex)
S1068	BlackCat	Malware	[BlackCat](https://attack.mitre.org/software/S1068) has the ability modify access tokens.(Citation: Microsoft BlackCat Jun 2022)(Citation: Sophos Blac...

References

• netbiosX. (2017, April 3). Token Manipulation. Retrieved April 21, 2017.

Frequently Asked Questions

What is T1134 (Access Token Manipulation)?

T1134 is a MITRE ATT&CK technique named 'Access Token Manipulation'. It belongs to the Stealth, Privilege Escalation tactic(s). Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership o...

How can T1134 be detected?

Detection of T1134 (Access Token Manipulation) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.

What mitigations exist for T1134?

There are 2 documented mitigations for T1134. Key mitigations include: User Account Management, Privileged Account Management.

Which threat groups use T1134?

Known threat groups using T1134 include: Lotus Blossom, FIN6, Blue Mockingbird.