{"id":"T1134.001","name":"Token Impersonation/Theft","url":"https://attack.mitre.org/techniques/T1134/001","tactics":["stealth","privilege-escalation"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0482","stix_id":"x-mitre-detection-strategy--0b06e42c-ab1c-4fb7-834b-10293e904173","name":"Behavior-chain detection for T1134.001 Access Token Manipulation: Token Impersonation/Theft on Windows","url":"https://attack.mitre.org/detectionstrategies/DET0482","analytics":[{"id":"AN1324","stix_id":"x-mitre-analytic--b76aeebb-3915-48ed-ac35-6af54c88c3bb","name":"Analytic 1324","description":"Detection of token duplication and impersonation attempts by correlating suspicious command-line executions (e.g., runas) with API calls to DuplicateToken, DuplicateTokenEx, ImpersonateLoggedOnUser, or SetThreadToken. The chain includes the initial command execution or in-memory API invocation → token handle duplication or thread token assignment → a new or existing process assuming the impersonated user's context.","url":"https://attack.mitre.org/detectionstrategies/DET0482#AN1324","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"},{"name":"ETW:Token","channel":"api_call: DuplicateTokenEx, ImpersonateLoggedOnUser, SetThreadToken","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"etw-token"}],"mutable_elements":[{"field":"AllowedSystemProcesses","description":"Whitelist of known processes that legitimately duplicate tokens (e.g., services.exe)."},{"field":"TimeWindow","description":"Time interval between API call and subsequent impersonated process (e.g., 5m)."},{"field":"UserContextFilter","description":"Filter for service accounts or known administrative accounts that perform legitimate impersonation."},{"field":"ParentProcessAnomalyThreshold","description":"Threshold for parent-child process lineage anomalies indicating token theft."}],"live":true,"detection_strategies":["DET0482"],"techniques":["T1134.001"]}],"live":true,"version":"1.0","techniques":["T1134.001"]}],"sigma_rules":[{"id":"02f7c9c1-1ae8-4c6a-8add-04693807f92f","title":"Potential Access Token Abuse","author":"Michaela Adams, Zach Mathis","status":"test","level":"medium","date":"2022-11-06","modified":"2023-04-26","description":"Detects potential token impersonation and theft. Example, when using \"DuplicateToken(Ex)\" and \"ImpersonateLoggedOnUser\" with the \"LOGON32_LOGON_NEW_CREDENTIALS flag\".","references":["https://www.elastic.co/fr/blog/how-attackers-abuse-access-token-manipulation","https://www.manageengine.com/log-management/cyber-security/access-token-manipulation.html"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1134.001","stp.4u"],"path":"rules/windows/builtin/security/account_management/win_security_access_token_abuse.yml","techniques":["T1134.001"],"cves":[]},{"id":"0adc67e0-a68f-4ffd-9c43-28905aad5d6a","title":"HackTool - Koh Default Named Pipe","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"critical","date":"2022-07-08","modified":"2023-08-07","description":"Detects creation of default named pipes used by the Koh tool","references":["https://github.com/GhostPack/Koh/blob/0283d9f3f91cf74732ad377821986cfcb088e20a/Clients/BOF/KohClient.c#L12"],"logsource":{"product":"windows","category":"pipe_created"},"tags":["attack.privilege-escalation","attack.credential-access","attack.stealth","attack.t1528","attack.t1134.001"],"path":"rules/windows/pipe_created/pipe_created_hktl_koh_default_pipe.yml","techniques":["T1528","T1134.001"],"cves":[]},{"id":"15619216-e993-4721-b590-4c520615a67d","title":"Potential Meterpreter/CobaltStrike Activity","author":"Teymur Kheirkhabarov, Ecco, Florian Roth","status":"test","level":"high","date":"2019-10-26","modified":"2023-02-05","description":"Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting","references":["https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment","https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1134.001","attack.t1134.002"],"path":"rules/windows/process_creation/proc_creation_win_hktl_meterpreter_getsystem.yml","techniques":["T1134.001","T1134.002"],"cves":[]},{"id":"7b14c76a-c602-4ae6-9717-eff868153fc0","title":"HackTool - NoFilter Execution","author":"Stamatis Chatzimangou (st0pp3r)","status":"test","level":"high","date":"2024-01-05","modified":null,"description":"Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators\n","references":["https://github.com/deepinstinct/NoFilter/blob/121d215ab130c5e8e3ad45a7e7fcd56f4de97b4d/NoFilter/Consts.cpp","https://github.com/deepinstinct/NoFilter","https://www.deepinstinct.com/blog/nofilter-abusing-windows-filtering-platform-for-privilege-escalation","https://x.com/_st0pp3r_/status/1742203752361128162?s=20"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1134","attack.t1134.001"],"path":"rules/windows/builtin/security/win_security_hktl_nofilter.yml","techniques":["T1134","T1134.001"],"cves":[]},{"id":"843544a7-56e0-4dcc-a44f-5cc266dd97d6","title":"Meterpreter or Cobalt Strike Getsystem Service Installation - System","author":"Teymur Kheirkhabarov, Ecco, Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2019-10-26","modified":"2023-11-15","description":"Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation","references":["https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment","https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/"],"logsource":{"product":"windows","service":"system"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1134.001","attack.t1134.002"],"path":"rules/windows/builtin/system/service_control_manager/win_system_meterpreter_or_cobaltstrike_getsystem_service_installation.yml","techniques":["T1134.001","T1134.002"],"cves":[]},{"id":"c7d33b50-f690-4b51-8cfb-0fb912a31e57","title":"HackTool - SharpDPAPI Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2024-06-26","modified":null,"description":"Detects the execution of the SharpDPAPI tool based on CommandLine flags and PE metadata.\nSharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.\n","references":["https://github.com/GhostPack/SharpDPAPI"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1134.001","attack.t1134.003"],"path":"rules/windows/process_creation/proc_creation_win_hktl_sharp_dpapi_execution.yml","techniques":["T1134.001","T1134.003"],"cves":[]},{"id":"cf0c254b-22f1-4b2b-8221-e137b3c0af94","title":"HackTool - Impersonate Execution","author":"Sai Prashanth Pulisetti @pulisettis","status":"test","level":"medium","date":"2022-12-21","modified":"2024-11-23","description":"Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively","references":["https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/","https://github.com/sensepost/impersonate"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1134.001","attack.t1134.003"],"path":"rules/windows/process_creation/proc_creation_win_hktl_impersonate.yml","techniques":["T1134.001","T1134.003"],"cves":[]},{"id":"ecbc5e16-58e0-4521-9c60-eb9a7ea4ad34","title":"Meterpreter or Cobalt Strike Getsystem Service Installation - Security","author":"Teymur Kheirkhabarov, Ecco, Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2019-10-26","modified":"2023-11-15","description":"Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation","references":["https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment","https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1134.001","attack.t1134.002"],"path":"rules/windows/builtin/security/win_security_meterpreter_or_cobaltstrike_getsystem_service_install.yml","techniques":["T1134.001","T1134.002"],"cves":[]},{"id":"f89b08d0-77ad-4728-817b-9b16c5a69c7a","title":"HackTool - SharpImpersonation Execution","author":"Sai Prashanth Pulisetti @pulisettis, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-12-27","modified":"2023-02-13","description":"Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively","references":["https://s3cur3th1ssh1t.github.io/SharpImpersonation-Introduction/","https://github.com/S3cur3Th1sSh1t/SharpImpersonation"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1134.001","attack.t1134.003"],"path":"rules/windows/process_creation/proc_creation_win_hktl_sharp_impersonation.yml","techniques":["T1134.001","T1134.003"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2023-4966","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}