CmdID

CmdID / Techniques

T1134 Access Token Manipulation

Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. MITRE ATT&CK

2 Sigma rules T1134 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK
T1134.001Access Token Manipulation: Token Impersonation/Theft
T1134.002Access Token Manipulation: Create Process with Token
T1134.003Access Token Manipulation: Make and Impersonate Token
T1134.004Access Token Manipulation: Parent PID Spoofing

Sigma rules tagged with it

process creation, the highest levels first
highSuspicious SYSTEM User Process CreationFlorian Roth (Nextron Systems), David ANDRE (additional keywords) · Windows
mediumSuspicious Cross-User Process SpawnSwachchhanda Shrawan Poudel (Nextron Systems) · Windows