AN1375 Analytic 1375

Windows · attack.mitre.org · ATT&CK Enterprise v19.2

<p>A process creates a brand‑new logon session/token (LogonUser*/LsaLogonUser) and then assigns/impersonates it (SetThreadToken/ImpersonateLoggedOnUser) to run actions under that freshly created security context. Chain: (1) suspicious command or script block (e.g., runas /netonly, PowerShell P/Invoke of LogonUser) → (2) ETW/API evidence of LogonUser*/SetThreadToken → (3) Security 4624 New Logon (often LogonType=9 NewCredentials or 2/3 from a non‑interactive parent) with no interactive desktop → (4) sysmon 1 process(es) executing with the new LogonId/SID different from the parent process → (5) optional privileged ops/lateral movement.</p>

Detects: T1134.003 Make and Impersonate Token
Part of: DET0498 Behavior‑chain detection for T1134.003 Make and Impersonate Token (Windows)

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log source	Channel	Data component
WinEventLog:Security	`EventCode=4688`	DC0032 Process Creation
WinEventLog:Security	`EventCode=4672`	DC0088 Logon Session Metadata
etw:Microsoft-Windows-Security-Auditing	`api_call: LogonUser(A\|W), LsaLogonUser, SetThreadToken, ImpersonateLoggedOnUser`	DC0021 OS API Execution

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

Field	Description
`TimeWindow`	Correlation window between LogonUser*/SetThreadToken and the first spawned process (default 5–10 minutes).
`SuspiciousLogonTypes`	Which 4624 LogonTypes to treat as high risk (e.g., 9 NewCredentials, 3 Network when sourced locally).
`AllowedImpersonators`	Processes/accounts legitimately creating tokens (e.g., winlogon.exe, lsass.exe, IIS worker, trusted service accounts).
`ParentChildUserMismatch`	Whether to alert on any SID/LogonId mismatch between parent/child not in allow-list.
`IntegrityEscalationDelta`	Minimum integrity level jump (e.g., Medium→High/System) to raise severity.