Detecting access token manipulation (T1134)

What is access token manipulation (T1134)?

MITRE ATT&CK® Access Token Manipulation (T1134) describes techniques where adversaries manipulate Windows access tokens to operate under a different user identity, escalate privileges, or evade detection. Access tokens are security objects that define the privilege set and group memberships of a running process or thread. By stealing or forging them, an attacker can impersonate any logged-in user, including SYSTEM, without knowing their password.

T1134 is a privilege escalation technique closely related to token manipulation patterns frequently observed in post-exploitation frameworks such as Metasploit, Cobalt Strike, and custom malware. It is distinct from credential-based attacks: no password is required and only access to a process whose token can be duplicated or impersonated.

T1134 sub-techniques

T1134 encompasses five sub-techniques, each targeting a different aspect of the Windows token model. Log360 detection coverage spans the highest-impact sub-techniques through Windows Security Event Logs and Sysmon telemetry:

How attackers use T1134

T1134 attacks are typically executed post-initial-access, after an attacker has established a foothold on a Windows host with at least low-privilege access. The attack progression follows a consistent pattern:

1. Identify available tokens: The attacker uses tools like Incognito (Metasploit module), TokenPlayer, or Cobalt Strike's steal_token command to enumerate available tokens on the compromised host. Any logged-in user's token, including SYSTEM, NETWORK SERVICE, or domain accounts, which is a potential target if the attacker holds SeImpersonatePrivilege.
2. Steal or duplicate the target token: Using Windows API calls (OpenProcessToken, DuplicateToken, ImpersonateLoggedOnUser), the attacker duplicates the target token. No authentication occurs as the attacker inherits the security context of the token's original owner without credentials.
3. Execute under the stolen identity: The attacker uses CreateProcessWithTokenW to spawn a new process, typically cmd.exe or PowerShell, running under the stolen SYSTEM or privileged user token. From this point, the attacker operates with full privileges of the impersonated account.
4. Escalate and persist: With SYSTEM access, the attacker installs malicious services, disables security tools, dumps credentials from LSASS, and prepares for lateral movement using alternate authentication material (T1550). Remote services (T1021) are commonly abused using credentials obtained after achieving SYSTEM.

Detection indicators for T1134

T1134 detection requires telemetry from both standard Windows Security Event Logs and Sysmon. The API-level token operations that define T1134 are not surfaced by Windows audit logging alone. Sysmon's process access and remote thread events are essential for high-fidelity detection.

Privilege assignment indicators

• SeImpersonatePrivilege or SeDebugPrivilege assigned to unexpected accounts (Event ID 4672): Every time a new logon session is created with these privileges, Event ID 4672 fires. Monitoring for these privileges on accounts that should not hold them, such as standard user accounts, web application service accounts, or SQL service accounts, flags potential T1134 preconditions.
• Privileged service call anomalies (Event ID 4673): Unusual calls to privilege-requiring services, particularly from processes that don't normally make such calls, indicate active token manipulation. Event ID 4673 records the specific privilege invoked and the calling process.

Token theft and process creation indicators

• Process creation under a different account than the parent (Event ID 4688): When a process runs under a different account than its parent, especially a SYSTEM-level process with a standard user parent, it indicates token substitution. Combined with the absence of a UAC elevation event (consent.exe), this is a high-confidence T1134.002 indicator.
• NewCredentials logon (Event ID 4624, logon type 9): Logon type 9 indicates a process used LogonUser with a token rather than interactive or network credentials. Processes generating logon type 9 events from unusual parent processes (e.g., cmd.exe, powershell.exe) indicate Make and impersonate token (T1134.003).
• ProcessAccess events targeting LSASS or high-privilege processes (Sysmon Event ID 10): Token theft via OpenProcessToken requires access to the target process. Sysmon Event ID 10 captures these OpenProcess calls with their requested access rights — PROCESS_QUERY_INFORMATION (0x0400) combined with PROCESS_DUP_HANDLE (0x0040) is the access mask pattern for token theft.
• Parent PID mismatch (Sysmon Event ID 1): Sysmon records both the process's reported parent PID and the actual creating process. When these differ, a process claims explorer.exe as parent but was actually created by a different process and it indicates parent PID spoofing (T1134.004).

SID-history injection indicators (T1134.005)

• SID history modified on a user account (Event ID 4765): This event fires whenever the sIDHistory attribute is written on an AD user account. Any modification to SID history outside of a documented migration scenario is an immediate high-severity indicator. Event ID 4766 captures failed SID history addition attempts.

Log360 detection rules for T1134

ManageEngine Log360 covers T1134 Access Token Manipulation through prebuilt behavioral rules spanning token impersonation tools, suspicious parent process chains, and process injection patterns. The following rules are mapped to T1134 in the Log360 threat detection engine:

Investigation steps

When Log360 fires a T1134-related alert, follow this investigation sequence to confirm the token manipulation, identify the impersonated identity, and determine the full impact:

1. Identify the token source: Determine which account's token was manipulated. In the Log360 alert, note the target process (whose token was stolen) and the actor process (which performed the duplication). For Potato attacks, the target is typically winlogon.exe, spoolsv.exe, or another SYSTEM-level service.
2. Trace all processes launched under the stolen token: Search Log360 for Event ID 4688 events following the alert timestamp where the process user context matches the impersonated identity (e.g., SYSTEM) but the parent process is unexpected. This maps the full attack execution chain under the stolen token.
3. Check for privilege escalation artifacts: Review Event ID 7045 (new service), 4698 (scheduled task), and 4720 (new account created) in the 10-minute post-alert window. These indicate persistence mechanisms installed using the elevated token access.
4. Review LSASS access events: With SYSTEM access, credential dumping via LSASS is the immediate next step in most T1134 attack chains. Search Sysmon Event ID 10 for TargetImage: lsass.exe from the actor process or its children. Any LSASS access attempt confirms credential theft risk — rotate all credentials for accounts that had active sessions on the host.
5. Check for SID-history changes (T1134.005): Search Active Directory audit logs for Event ID 4765. If SID-history was modified, identify the account affected, the SID added, and whether that SID corresponds to a highly privileged group (Domain Admins, Enterprise Admins). All AD actions performed by the affected account since the modification must be reviewed.
6. Assess lateral movement: Token manipulation with SYSTEM access enables pass-the-hash (T1550) and remote service abuse (T1021). Check for logon events (4624) from the affected host to other systems in the environment during the post-alert window. Log360 UEBA will surface anomalous lateral logon patterns automatically.

Response playbook

• Isolate the affected host immediately: T1134 token manipulation that achieves SYSTEM access enables credential harvesting and lateral movement within seconds. Remove the host from the network before investigating to limit blast radius.
• Terminate impersonating processes: Identify and kill all processes running under the stolen token identity. Use the Log360 process chain view to map the full process tree spawned under the impersonated context.
• Remove persistence mechanisms: Check for services (Event ID 7045), scheduled tasks (Event ID 4698), startup entries, and registry run keys created during the token manipulation session. Remove all unauthorized entries and verify the service binary paths.
• Rotate all credentials exposed on the host: With SYSTEM access, LSASS credential extraction is trivial. Treat all credentials cached on the affected host as compromised: local admin (LAPS rotation), service accounts, domain accounts that logged on interactively. Prioritize accounts with domain-wide permissions.
• For SID-history injection (T1134.005): Immediately remove the unauthorized SID-history entry from the affected AD account. Review all actions performed by that account while the malicious SID-history was present — particularly privilege use, group membership changes, and data access. Run Get-ADUser -Filter * -Properties SIDHistory across all accounts to identify any other affected accounts.
• Harden SeImpersonatePrivilege assignments: Audit which accounts hold SeImpersonatePrivilege on the affected host. Remove it from any accounts that don't require it — particularly web application accounts and database service accounts. Consider using Windows Local Administrator Password Solution (LAPS) and Microsoft's Privileged Access Workstations (PAW) guidance to restrict privilege scope.
• Threat hunt across the environment: T1134 is often part of a broader attack chain. Run a threat hunt using Log360 for the same token manipulation indicators across all hosts in the affected network segment. Use the MITRE ATT&CK framework to check for adjacent techniques: Valid accounts (T1078), Abuse elevation control (T1548), and credential dumping (T1003) are frequently co-occurring techniques.

Need to explore ManageEngine Log360? Schedule a personalized demo

Frequently asked questions