Techniques › T1134 › T1134.001
T1134.001 Token Impersonation/Theft
stealth · privilege escalation — Windows · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
9
Sigma rules tagged attack.t1134.001
1
KEV CVEs mapped here
<p>Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using
DuplicateToken or DuplicateTokenEx. The token can then be used with ImpersonateLoggedOnUser to allow the calling thread to impersonate a logged on user's security context, or with SetThreadToken to assign the impersonated token to a thread.</p><p>An adversary may perform Token Impersonation/Theft when they have a specific, existing process they want to assign the duplicated token to. For example, this may be useful for when the target user has a non-network logon session on the system.</p><p>When an adversary would instead use a duplicated token to create a new process rather than attaching to an existing process, they can additionally Create Process with Token using CreateProcessWithTokenW or CreateProcessAsUserW. Token Impersonation/Theft is also distinct from Make and Impersonate Token in that it refers to duplicating an existing token, rather than creating a new one.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2023-4966 | Citrix NetScaler ADC and NetScaler Gateway | secondary impact | Mapped | 2023-10-18 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0482 Behavior-chain detection for T1134.001 Access Token Manipulation: Token Impersonation/Theft on Windows v1.0
AN1324 WindowsDetection of token duplication and impersonation attempts by correlating suspicious command-line executions (e.g., runas) with API calls to DuplicateToken, DuplicateTokenEx, ImpersonateLoggedOnUser, or SetThreadToken. The chain includes the initial command execution or in-memory API invocation → token handle duplication or thread token assignment → a new or existing process assuming the impersonated user's context.ETW:Token
api_call: DuplicateTokenEx, ImpersonateLoggedOnUser, SetThreadToken→ DC0021 OS API ExecutionTunable:AllowedSystemProcessesTimeWindowUserContextFilterParentProcessAnomalyThreshold
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1134.001
Author: Michaela Adams, Zach Mathis
· 2022-11-06 (modified 2023-04-26) · logsource: product=windows service=security · 02f7c9c1-1ae8-4c6a-8add-04693807f92f
Detects potential token impersonation and theft. Example, when using "DuplicateToken(Ex)" and "ImpersonateLoggedOnUser" with the "LOGON32_LOGON_NEW_CREDENTIALS flag".
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-07-08 (modified 2023-08-07) · logsource: product=windows category=pipe_created · 0adc67e0-a68f-4ffd-9c43-28905aad5d6a
Detects creation of default named pipes used by the Koh tool
Author: Teymur Kheirkhabarov, Ecco, Florian Roth
· 2019-10-26 (modified 2023-02-05) · logsource: product=windows category=process_creation · 15619216-e993-4721-b590-4c520615a67d
Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting
Author: Stamatis Chatzimangou (st0pp3r)
· 2024-01-05 · logsource: product=windows service=security · 7b14c76a-c602-4ae6-9717-eff868153fc0
Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators
Author: Teymur Kheirkhabarov, Ecco, Florian Roth (Nextron Systems)
· 2019-10-26 (modified 2023-11-15) · logsource: product=windows service=system · 843544a7-56e0-4dcc-a44f-5cc266dd97d6
Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation
Author: Nasreddine Bencherchali (Nextron Systems)
· 2024-06-26 · logsource: product=windows category=process_creation · c7d33b50-f690-4b51-8cfb-0fb912a31e57
Detects the execution of the SharpDPAPI tool based on CommandLine flags and PE metadata.
SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.
Author: Sai Prashanth Pulisetti @pulisettis
· 2022-12-21 (modified 2024-11-23) · logsource: product=windows category=process_creation · cf0c254b-22f1-4b2b-8221-e137b3c0af94
Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively
Author: Teymur Kheirkhabarov, Ecco, Florian Roth (Nextron Systems)
· 2019-10-26 (modified 2023-11-15) · logsource: product=windows service=security · ecbc5e16-58e0-4521-9c60-eb9a7ea4ad34
Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation
Author: Sai Prashanth Pulisetti @pulisettis, Nasreddine Bencherchali (Nextron Systems)
· 2022-12-27 (modified 2023-02-13) · logsource: product=windows category=process_creation · f89b08d0-77ad-4728-817b-9b16c5a69c7a
Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively
Rules tagged at the parent level (attack.t1134) 4
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Florian Roth (Nextron Systems), David ANDRE (additional keywords)
· 2021-12-20 (modified 2025-10-19) · logsource: product=windows category=process_creation · 2617e7ed-adb7-40ba-b0f3-8f9945fe6c09
Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)
Author: Stamatis Chatzimangou (st0pp3r)
· 2024-01-05 · logsource: product=windows service=security · 7b14c76a-c602-4ae6-9717-eff868153fc0
Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-07-23 · logsource: product=windows category=process_creation · d2b7a134-9c3e-4f8a-b56d-e0c1f8a29b47
Detects suspicious spawning of a process under a different user context than the parent process.
Processes such as notepad.exe, calculator etc. are generally spawned under the same user context and
also they are often targeted as sacrificial process or decoy process to check successful privilege escalation.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-07-23 · logsource: product=windows service=security · e3c6d245-7b8f-4e2a-c17f-a9d0e5b38f62
Detects potentially suspicious explicit credential logon events where the user
is trying to logon with explicit credentials (username and password) that are
different from the current user context. It might indicate an attacker attempting
to escalate privileges after obtaining credentials for a different user account.