Techniques › T1134 › AN0786
AN0786 Analytic 0786
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection of suspicious token manipulation chains: use of token-related APIs (e.g., LogonUser, DuplicateTokenEx) or commands (runas) → spawning of a new process under a different security context (e.g., SYSTEM) → mismatched parent-child process lineage or anomalies in Event Tracing for Windows (ETW) token/PPID data → abnormal lateral or privilege escalation activity.</p>
- Detects
- T1134 Access Token Manipulation
- Part of
- DET0283 Behavior-chain detection for T1134 Access Token Manipulation on Windows
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4672, 4634 | DC0088 Logon Session Metadata |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=10 | DC0035 Process Access |
| ETW:Token | token_analysis: API calls such as DuplicateTokenEx or ImpersonateLoggedOnUser | DC0021 OS API Execution |
| WinEventLog:Security | EventCode=5136 | DC0066 Active Directory Object Modification |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Correlation time between suspicious API usage, runas, and process creation (e.g., 5–10m). |
AllowedServiceAccounts | Whitelist of service accounts permitted to spawn SYSTEM-level processes. |
KnownAdminTools | Legitimate administrative utilities that trigger token changes. |
ParentProcessAnomalyThreshold | Deviation threshold for PPID mismatches detected via ETW. |