Which SIEM platforms have a T1134.002 detection rule?

df00tech provides T1134.002 (Create Process with Token) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Create Process with Token (T1134.002)?

Detecting Create Process with Token requires the following data sources: Process: Process Creation, Process: OS API Execution, Microsoft Defender for Endpoint.

What severity and confidence is the T1134.002 detection?

The T1134.002 detection is rated high severity with medium confidence.

What are common false positives for T1134.002?

Common false positives for T1134.002 include: Software installation tools and MSI packages that legitimately spawn elevated child processes via runas.exe or UAC prompts during setup routines; System administration scripts that use runas to execute maintenance tasks under alternate credentials as part of a least-privilege administrative workflow; IT automation platforms (SCCM, Ansible WinRM, PDQ Deploy) that execute tasks as a service account distinct from the initiating agent process, producing account context switches.

T1134.002 IBM QRadar · QRadar

Detect Create Process with Token in IBM QRadar

Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as CreateProcessWithTokenW, CreateProcessAsUser, and runas. Creating processes with a token not associated with the current user may require the credentials of the target user, specific privileges to impersonate that user, or access to the token to be used. The token could be duplicated via Token Impersonation/Theft (T1134.001) or created via Make and Impersonate Token (T1134.003) before being used to create a new process. This technique has been observed in campaigns by Turla, Lazarus Group, KONNI, Azorult, Bankshot, REvil, WhisperGate, and Empire post-exploitation frameworks.

MITRE ATT&CK

Tactic: Defense Evasion Privilege Escalation
Technique: T1134 Access Token Manipulation
Sub-technique: T1134.002 Create Process with Token
Canonical reference: https://attack.mitre.org/techniques/T1134/002/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  "username",
  "domain",
  QIDNAME(qid) AS event_name,
  "Process Name",
  "Command",
  "Parent Process Name",
  "Parent Command",
  CASE
    WHEN LOWER("Process Name") LIKE '%advancedrun.exe%' OR LOWER("Parent Process Name") LIKE '%advancedrun.exe%'
      THEN 'AdvancedRunTool'
    WHEN LOWER("Parent Process Name") LIKE '%runas.exe%'
      AND LOWER("Process Name") NOT LIKE '%consent.exe%'
      AND LOWER("Process Name") NOT LIKE '%werfault.exe%'
      THEN 'RunasParent'
    WHEN (
      LOWER("Parent Process Name") LIKE '%cmd.exe%' OR
      LOWER("Parent Process Name") LIKE '%powershell.exe%' OR
      LOWER("Parent Process Name") LIKE '%pwsh.exe%' OR
      LOWER("Parent Process Name") LIKE '%wscript.exe%' OR
      LOWER("Parent Process Name") LIKE '%cscript.exe%' OR
      LOWER("Parent Process Name") LIKE '%mshta.exe%' OR
      LOWER("Parent Process Name") LIKE '%rundll32.exe%' OR
      LOWER("Parent Process Name") LIKE '%regsvr32.exe%' OR
      LOWER("Parent Process Name") LIKE '%wmic.exe%'
    ) AND (
      LOWER("Command") LIKE '%trustedinstaller%' OR
      LOWER("Parent Command") LIKE '%trustedinstaller%'
    ) THEN 'TrustedInstallerAbuse'
    ELSE 'IntegrityEscalation'
  END AS detection_branch,
  sourceip
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) IN (
    SELECT id FROM LOGSOURCETYPE WHERE name LIKE '%Windows%' OR name LIKE '%Sysmon%'
  )
  AND qid IN (
    SELECT id FROM QID WHERE name LIKE '%Process Create%' OR name LIKE '%4688%' OR name LIKE 'Sysmon%1%'
  )
  AND (
    LOWER("Process Name") LIKE '%advancedrun.exe%'
    OR LOWER("Parent Process Name") LIKE '%advancedrun.exe%'
    OR (
      LOWER("Parent Process Name") LIKE '%runas.exe%'
      AND LOWER("Process Name") NOT LIKE '%consent.exe%'
      AND LOWER("Process Name") NOT LIKE '%werfault.exe%'
    )
    OR (
      (
        LOWER("Parent Process Name") LIKE '%cmd.exe%' OR
        LOWER("Parent Process Name") LIKE '%powershell.exe%' OR
        LOWER("Parent Process Name") LIKE '%pwsh.exe%' OR
        LOWER("Parent Process Name") LIKE '%wscript.exe%' OR
        LOWER("Parent Process Name") LIKE '%cscript.exe%' OR
        LOWER("Parent Process Name") LIKE '%mshta.exe%' OR
        LOWER("Parent Process Name") LIKE '%rundll32.exe%' OR
        LOWER("Parent Process Name") LIKE '%regsvr32.exe%'
      )
      AND (
        LOWER("Command") LIKE '%trustedinstaller%' OR
        LOWER("Parent Command") LIKE '%trustedinstaller%'
      )
    )
  )
  AND LOGSOURCETIME BETWEEN NOW() - 86400000 AND NOW()
ORDER BY starttime DESC
LIMIT 500

high severity medium confidence

Detects T1134.002 token-based process creation in QRadar by querying Windows/Sysmon process creation events for AdvancedRun.exe usage, runas.exe parent chains, and TrustedInstaller command-line abuse from scripting engine parents.

Data Sources

Windows Security Event Log (WinCollect)Sysmon via WinCollectMicrosoft Windows DSM

Required Tables

events

False Positives & Tuning

IT administrators using runas.exe for legitimate privilege escalation during maintenance tasks or software installation on endpoints.
Automated deployment or configuration management systems that legitimately invoke elevated processes through scripting engines during software provisioning.
Security tools such as vulnerability scanners or EDR agents that may spawn child processes with elevated integrity levels as part of their normal operation.

Download portable Sigma rule (.yml)

Other platforms for T1134.002

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Process Creation via runas with Alternate User Token
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with User=<hostname>\TestUser and IntegrityLevel=Medium, with ParentImage=runas.exe. Security Event 4648 (Explicit credentials used) with TargetUserName=TestUser, ProcessName=C:\Windows\System32\runas.exe, LogonType=9 (NewCredentials). Security Event 4624 (Logon successful) with LogonType=9 for the new TestUser session. Security Event 4672 if TestUser is in any privileged group.
Test 2AdvancedRun.exe for TrustedInstaller-Level Process Execution
Expected signal: Sysmon Event ID 1 (AdvancedRun.exe launch): Image=AdvancedRun.exe from %TEMP%, IntegrityLevel=Medium. Sysmon Event ID 1 (cmd.exe spawn): Image=cmd.exe, User=NT SERVICE\TrustedInstaller, IntegrityLevel=System, ParentImage=AdvancedRun.exe. Sysmon Event ID 11: file creation at C:\Temp\ti-test.txt by cmd.exe running as TrustedInstaller. Prefetch file created at C:\Windows\Prefetch\ADVANCEDRUN.EXE-*.pf.
Test 3WTSQueryUserToken Pattern via PowerShell P/Invoke
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with IntegrityLevel=Medium (or System if launched via PsExec -s). PowerShell ScriptBlock Event ID 4104: records the Add-Type definition including 'WTSQueryUserToken' and 'WTSGetActiveConsoleSessionId'. Sysmon Event ID 7 (Image Load): Wtsapi32.dll loaded by powershell.exe — this DLL load by a scripting engine is an anomaly indicator. If running as SYSTEM, Security Event 4624 with LogonType=9 follows the successful token query.
Test 4Token Theft via PowerShell and CreateProcessAsUser (Invoke-RunAs simulation)
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with the -ExecutionPolicy Bypass flag. PowerShell ScriptBlock Event ID 4104: records the Add-Type definition containing 'OpenProcessToken', 'DuplicateTokenEx', 'CreateProcessWithTokenW'. Sysmon Event ID 7 (Image Load): advapi32.dll invoked via P/Invoke by powershell.exe for token manipulation. If run from elevated context, Security Event 4673 (Sensitive Privilege Use) for SeImpersonatePrivilege use.

Last updated: 2026-04-18 Research depth: deep

References (9)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1134.002 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Create Process with Token in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1134.002

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1134.002

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

Get new detections in your inbox