T1134 Access Token Manipulation
Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. MITRE ATT&CK
2 Sigma rules T1134 on attack.mitre.org
Its sub-techniques
Sigma rules tagged with it
highSuspicious SYSTEM User Process CreationFlorian Roth (Nextron Systems), David ANDRE (additional keywords) · Windows