CmdID / Techniques / T1134

T1134.003 Access Token Manipulation: Make and Impersonate Token

Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. MITRE ATT&CK

3 Sigma rules T1134.003 on attack.mitre.org