AN1253 Analytic 1253

Windows · attack.mitre.org · ATT&CK Enterprise v19.2

<p>A process (often after stealing/creating a token) calls CreateProcessWithTokenW/CreateProcessAsUserW or uses runas to spawn a new process whose security context (SID/LogonId/IntegrityLevel) differs from its parent. Chain: (1) suspicious command/API → (2) privileged handle or token duplication/open → (3) new child process running as another user / higher integrity → (4) optional follow‑on privileged/lateral actions.</p>

Detects: T1134.002 Create Process with Token
Part of: DET0456 Behavior-chain detection for T1134.002 Create Process with Token (Windows)

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log source	Channel	Data component
WinEventLog:Security	`EventCode=4688`	DC0032 Process Creation
WinEventLog:Sysmon	`EventCode=10`	DC0035 Process Access
ETW:ProcThread	`api_call: CreateProcessWithTokenW, CreateProcessAsUserW`	DC0021 OS API Execution
WinEventLog:Security	`EventCode=4672, 4634`	DC0088 Logon Session Metadata
WinEventLog:Security	`EventCode=5136`	DC0066 Active Directory Object Modification

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

Field	Description
`TimeWindow`	Correlation window between API/handle access and the spawned process (default 5–10 minutes).
`AllowedImpersonators`	Service accounts/binaries legitimately using CreateProcessWithTokenW (e.g., PsExec service, SCCM, backup agents).
`IntegrityEscalationDelta`	Minimum jump in integrity level (e.g., Medium→System) to flag.
`ParentChildUserMismatch`	Treat any parent/child SID or LogonId mismatch as suspicious unless on allow-list.
`SensitiveTargets`	List of processes (e.g., lsass.exe, winlogon.exe, services.exe) whose token access prior to the spawn raises score.