T1134.002 Access Token Manipulation: Create Process with Token

Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. MITRE ATT&CK

1 program on CmdID 5 Sigma rules T1134.002 on attack.mitre.org

Part of

MITRE ATT&CK

T1134Access Token Manipulation

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

highPotential Meterpreter/CobaltStrike ActivityTeymur Kheirkhabarov, Ecco, Florian Roth · Windows

highPUA - AdvancedRun Suspicious ExecutionFlorian Roth (Nextron Systems) · Windows

highRedSun - Conhost.exe Spawned by TieringEngineService.exeSwachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost · Windows

highSuspicious Child Process Created as SystemTeymur Kheirkhabarov, Roberto Rodriguez (@Cyb3rWard0g), Open Threat Research (OTR) · Windows

mediumPUA - AdvancedRun ExecutionFlorian Roth (Nextron Systems) · Windows