kevmap

Techniques › T1134 › T1134.002

T1134.002 Create Process with Token

stealth · privilege escalation — Windows · attack.mitre.org · JSON

1
MITRE detection strategy
1
analytics
7
Sigma rules tagged attack.t1134.002
0
KEV CVEs mapped here
<p>Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as <code>CreateProcessWithTokenW</code> and <code>runas</code>.</p><p>Creating processes with a token not associated with the current user may require the credentials of the target user, specific privileges to impersonate that user, or access to the token to be used. For example, the token could be duplicated via Token Impersonation/Theft or created via Make and Impersonate Token before being used to create a process.</p><p>While this technique is distinct from Token Impersonation/Theft, the techniques can be used in conjunction where a token is duplicated and then used to create a new process.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1134.002

Potential Meterpreter/CobaltStrike Activity hightest
Author: Teymur Kheirkhabarov, Ecco, Florian Roth · 2019-10-26 (modified 2023-02-05) · logsource: product=windows category=process_creation · 15619216-e993-4721-b590-4c520615a67d
Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting
Techniques: T1134.001T1134.002
RedSun - Conhost.exe Spawned by TieringEngineService.exe highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost · 2026-04-17 · logsource: product=windows category=process_creation · 2ad78473-6978-40f5-b8f1-89c7e1c27a1a
Detects two stages of the RedSun post-exploitation process chain that deliver a SYSTEM-level shell to the attacker's interactive session. Observed process chain services.exe → TieringEngineService.exe → conhost.exe (SYSTEM, CommandLine: bare path, no arguments) → cmd.exe / shell (SYSTEM, TerminalSessionId = attacker's session) Stage 1 — TieringEngineService.exe spawns argument-less conhost.exe: After winning the oplock + Cloud Files mount point race, the malicious TieringEngineService.exe (RedSun.exe copied to System32, started via CoCreateInstance / services.exe) detects it is NT AUTHORITY\SYSTEM and calls LaunchConsoleInSessionId(). This opens \\.\pipe\REDSUN, reads the attacker's session ID, duplicates the SYSTEM token, re-stamps it with that session ID via SetTokenInformation(TokenSessionId), then calls CreateProcessAsUser to spawn conhost.exe with no arguments. Stage 2 — Shell spawned from rogue conhost.exe (EDR sources with GrandParentImage): The rogue SYSTEM conhost.exe spawns a shell (cmd.exe, PowerShell, etc.) as SYSTEM in the attacker's interactive session. On EDR sources that expose GrandParentImage, the full three-level chain (TieringEngineService.exe → conhost.exe → shell) can be matched directly. The legitimate TieringEngineService.exe is a headless COM server that is unlikely to spawn conhost.exe under normal conditions.
Techniques: T1134.002T1036.005
Suspicious Child Process Created as System hightest
Author: Teymur Kheirkhabarov, Roberto Rodriguez (@Cyb3rWard0g), Open Threat Research (OTR) · 2019-10-26 (modified 2024-12-01) · logsource: product=windows category=process_creation · 590a5f4c-6c8c-4f10-8307-89afe9453a9d
Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts
Techniques: T1134.002
Meterpreter or Cobalt Strike Getsystem Service Installation - System hightest
Author: Teymur Kheirkhabarov, Ecco, Florian Roth (Nextron Systems) · 2019-10-26 (modified 2023-11-15) · logsource: product=windows service=system · 843544a7-56e0-4dcc-a44f-5cc266dd97d6
Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation
Techniques: T1134.001T1134.002
PUA - AdvancedRun Execution mediumtest
Author: Florian Roth (Nextron Systems) · 2022-01-20 (modified 2023-02-21) · logsource: product=windows category=process_creation · d2b749ee-4225-417e-b20e-a8d2193cbb84
Detects the execution of AdvancedRun utility
Techniques: T1564.003T1134.002T1059.003
Meterpreter or Cobalt Strike Getsystem Service Installation - Security hightest
Author: Teymur Kheirkhabarov, Ecco, Florian Roth (Nextron Systems) · 2019-10-26 (modified 2023-11-15) · logsource: product=windows service=security · ecbc5e16-58e0-4521-9c60-eb9a7ea4ad34
Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation
Techniques: T1134.001T1134.002
PUA - AdvancedRun Suspicious Execution hightest
Author: Florian Roth (Nextron Systems) · 2022-01-20 (modified 2023-02-21) · logsource: product=windows category=process_creation · fa00b701-44c6-4679-994d-5a18afa8a707
Detects the execution of AdvancedRun utility in the context of the TrustedInstaller, SYSTEM, Local Service or Network Service accounts
Techniques: T1134.002

Rules tagged at the parent level (attack.t1134) 4

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

Suspicious SYSTEM User Process Creation hightest
Author: Florian Roth (Nextron Systems), David ANDRE (additional keywords) · 2021-12-20 (modified 2025-10-19) · logsource: product=windows category=process_creation · 2617e7ed-adb7-40ba-b0f3-8f9945fe6c09
Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)
Techniques: T1134T1003T1027
HackTool - NoFilter Execution hightest
Author: Stamatis Chatzimangou (st0pp3r) · 2024-01-05 · logsource: product=windows service=security · 7b14c76a-c602-4ae6-9717-eff868153fc0
Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators
Techniques: T1134T1134.001
Suspicious Cross-User Process Spawn mediumexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-07-23 · logsource: product=windows category=process_creation · d2b7a134-9c3e-4f8a-b56d-e0c1f8a29b47
Detects suspicious spawning of a process under a different user context than the parent process. Processes such as notepad.exe, calculator etc. are generally spawned under the same user context and also they are often targeted as sacrificial process or decoy process to check successful privilege escalation.
Techniques: T1055T1134
Potentially Suspicious Explicit Credential Local Logon mediumexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-07-23 · logsource: product=windows service=security · e3c6d245-7b8f-4e2a-c17f-a9d0e5b38f62
Detects potentially suspicious explicit credential logon events where the user is trying to logon with explicit credentials (username and password) that are different from the current user context. It might indicate an attacker attempting to escalate privileges after obtaining credentials for a different user account.
Techniques: T1134T1134.003