Detect Create Process with Token in CrowdStrike LogScale
Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as CreateProcessWithTokenW, CreateProcessAsUser, and runas. Creating processes with a token not associated with the current user may require the credentials of the target user, specific privileges to impersonate that user, or access to the token to be used. The token could be duplicated via Token Impersonation/Theft (T1134.001) or created via Make and Impersonate Token (T1134.003) before being used to create a new process. This technique has been observed in campaigns by Turla, Lazarus Group, KONNI, Azorult, Bankshot, REvil, WhisperGate, and Empire post-exploitation frameworks.
MITRE ATT&CK
- Technique
- T1134 Access Token Manipulation
- Sub-technique
- T1134.002 Create Process with Token
- Canonical reference
- https://attack.mitre.org/techniques/T1134/002/
LogScale Detection Query
// T1134.002 - Create Process with Token Detection
// Matches: integrity escalation, runas parent, AdvancedRun.exe, TrustedInstaller abuse, account context switching
#event_simpleName=ProcessRollup2
| eval process_name_lower = lower(FileName)
| eval parent_name_lower = lower(ParentBaseFileName)
| eval cmdline_lower = lower(CommandLine)
| eval parent_cmdline_lower = lower(ParentCommandLine)
// Score each detection branch
| eval integrity_escalation = if(
(IntegrityLevel in ["High", "System"]) AND
(parent_name_lower in ["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "msiexec.exe", "wmic.exe"]) AND
NOT (process_name_lower in ["consent.exe", "werfault.exe", "dllhost.exe"]),
1, 0)
| eval runas_parent = if(
parent_name_lower = "runas.exe" AND
NOT (process_name_lower in ["consent.exe", "werfault.exe"]),
1, 0)
| eval advancedrun_tool = if(
process_name_lower = "advancedrun.exe" OR
parent_name_lower = "advancedrun.exe",
1, 0)
| eval trustedinstaller_abuse = if(
match(cmdline_lower, "trustedinstaller") OR
match(parent_cmdline_lower, "trustedinstaller"),
1, 0)
| eval account_context_switch = if(
UserName != ParentUserName AND
NOT (UserName in ["SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE", ""]) AND
NOT (ParentUserName in ["SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE", ""]) AND
(parent_name_lower in ["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe"]),
1, 0)
| eval suspicion_score = integrity_escalation + runas_parent + advancedrun_tool + trustedinstaller_abuse + account_context_switch
| where suspicion_score > 0
| eval detection_branches = array(
if(integrity_escalation=1, "IntegrityEscalation", null()),
if(runas_parent=1, "RunasParent", null()),
if(advancedrun_tool=1, "AdvancedRunTool", null()),
if(trustedinstaller_abuse=1, "TrustedInstallerAbuse", null()),
if(account_context_switch=1, "AccountContextSwitch", null())
)
| table
timestamp,
ComputerName,
UserName,
ParentUserName,
FileName,
CommandLine,
ParentBaseFileName,
ParentCommandLine,
IntegrityLevel,
suspicion_score,
detection_branches
| sort timestamp descCrowdStrike LogScale (Falcon) query detecting T1134.002 Create Process with Token by analyzing ProcessRollup2 events for integrity level escalation from scripting engine parents, account context switching, runas.exe parent chains, AdvancedRun.exe usage, and TrustedInstaller command-line references with a composite suspicion score.
Data Sources
Required Tables
False Positives & Tuning
- CrowdStrike Falcon sensor self-updates or configuration changes may spawn elevated processes from scripting wrappers as part of policy enforcement, triggering integrity escalation branches.
- Enterprise endpoint management suites running as SYSTEM that legitimately spawn user-context processes (context switch) during interactive session management or profile loading.
- Software packaging tools like InstallShield or Advanced Installer that use elevated token creation internally during MSI package execution, especially in enterprise silent-install scenarios.
Other platforms for T1134.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Process Creation via runas with Alternate User Token
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with User=<hostname>\TestUser and IntegrityLevel=Medium, with ParentImage=runas.exe. Security Event 4648 (Explicit credentials used) with TargetUserName=TestUser, ProcessName=C:\Windows\System32\runas.exe, LogonType=9 (NewCredentials). Security Event 4624 (Logon successful) with LogonType=9 for the new TestUser session. Security Event 4672 if TestUser is in any privileged group.
- Test 2AdvancedRun.exe for TrustedInstaller-Level Process Execution
Expected signal: Sysmon Event ID 1 (AdvancedRun.exe launch): Image=AdvancedRun.exe from %TEMP%, IntegrityLevel=Medium. Sysmon Event ID 1 (cmd.exe spawn): Image=cmd.exe, User=NT SERVICE\TrustedInstaller, IntegrityLevel=System, ParentImage=AdvancedRun.exe. Sysmon Event ID 11: file creation at C:\Temp\ti-test.txt by cmd.exe running as TrustedInstaller. Prefetch file created at C:\Windows\Prefetch\ADVANCEDRUN.EXE-*.pf.
- Test 3WTSQueryUserToken Pattern via PowerShell P/Invoke
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with IntegrityLevel=Medium (or System if launched via PsExec -s). PowerShell ScriptBlock Event ID 4104: records the Add-Type definition including 'WTSQueryUserToken' and 'WTSGetActiveConsoleSessionId'. Sysmon Event ID 7 (Image Load): Wtsapi32.dll loaded by powershell.exe — this DLL load by a scripting engine is an anomaly indicator. If running as SYSTEM, Security Event 4624 with LogonType=9 follows the successful token query.
- Test 4Token Theft via PowerShell and CreateProcessAsUser (Invoke-RunAs simulation)
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with the -ExecutionPolicy Bypass flag. PowerShell ScriptBlock Event ID 4104: records the Add-Type definition containing 'OpenProcessToken', 'DuplicateTokenEx', 'CreateProcessWithTokenW'. Sysmon Event ID 7 (Image Load): advapi32.dll invoked via P/Invoke by powershell.exe for token manipulation. If run from elevated context, Security Event 4673 (Sensitive Privilege Use) for SeImpersonatePrivilege use.
References (9)
- https://attack.mitre.org/techniques/T1134/002/
- https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createprocesswithtokenw
- https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessasusera
- https://docs.microsoft.com/en-us/windows/win32/api/wtsapi32/nf-wtsapi32-wtsqueryusertoken
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1134.002/T1134.002.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
- https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/manage/component-updates/command-line-process-auditing
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771525(v=ws.11)
Unlock Pro Content
Get the full detection package for T1134.002 including response playbook, investigation guide, and atomic red team tests.