CmdID

CmdID / Techniques / T1134

T1134.001 Access Token Manipulation: Token Impersonation/Theft

Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. MITRE ATT&CK

4 Sigma rules T1134.001 on attack.mitre.org

Part of

MITRE ATT&CK
T1134Access Token Manipulation

Sigma rules tagged with it

process creation, the highest levels first
highHackTool - SharpDPAPI ExecutionNasreddine Bencherchali (Nextron Systems) · Windows
highHackTool - SharpImpersonation ExecutionSai Prashanth Pulisetti @pulisettis, Nasreddine Bencherchali (Nextron Systems) · Windows
highPotential Meterpreter/CobaltStrike ActivityTeymur Kheirkhabarov, Ecco, Florian Roth · Windows
mediumHackTool - Impersonate ExecutionSai Prashanth Pulisetti @pulisettis · Windows