Detect Create Process with Token in Splunk
Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as CreateProcessWithTokenW, CreateProcessAsUser, and runas. Creating processes with a token not associated with the current user may require the credentials of the target user, specific privileges to impersonate that user, or access to the token to be used. The token could be duplicated via Token Impersonation/Theft (T1134.001) or created via Make and Impersonate Token (T1134.003) before being used to create a new process. This technique has been observed in campaigns by Turla, Lazarus Group, KONNI, Azorult, Bankshot, REvil, WhisperGate, and Empire post-exploitation frameworks.
MITRE ATT&CK
- Technique
- T1134 Access Token Manipulation
- Sub-technique
- T1134.002 Create Process with Token
- Canonical reference
- https://attack.mitre.org/techniques/T1134/002/
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval ImageLower=lower(Image)
| eval ParentImageLower=lower(ParentImage)
| eval IntegrityLevelLower=lower(IntegrityLevel)
| eval CommandLineLower=lower(CommandLine)
| eval ParentCommandLineLower=lower(ParentCommandLine)
| eval IntegrityEscalation=if(
(IntegrityLevelLower="high" OR IntegrityLevelLower="system") AND
match(ParentImageLower, "(\\\\cmd\\.exe|\\\\powershell\\.exe|\\\\pwsh\\.exe|\\\\wscript\\.exe|\\\\cscript\\.exe|\\\\mshta\\.exe|\\\\rundll32\\.exe|\\\\regsvr32\\.exe|\\\\wmic\\.exe)") AND
NOT match(ImageLower, "(\\\\consent\\.exe|\\\\werfault\\.exe|\\\\dllhost\\.exe)"), 1, 0)
| eval RunasParent=if(
match(ParentImageLower, "\\\\runas\\.exe") AND
NOT match(ImageLower, "(\\\\consent\\.exe|\\\\werfault\\.exe)"), 1, 0)
| eval AdvancedRunTool=if(
match(ImageLower, "\\\\advancedrun\\.exe") OR
match(ParentImageLower, "\\\\advancedrun\\.exe"), 1, 0)
| eval TrustedInstallerAbuse=if(
match(CommandLineLower, "trustedinstaller") OR
match(ParentCommandLineLower, "trustedinstaller"), 1, 0)
| eval SuspicionScore=IntegrityEscalation + RunasParent + AdvancedRunTool + TrustedInstallerAbuse
| where SuspicionScore > 0
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine,
IntegrityLevel, IntegrityEscalation, RunasParent, AdvancedRunTool, TrustedInstallerAbuse, SuspicionScore
| sort - _timeDetects process creation with token substitution using Sysmon Event ID 1 (Process Creation). Evaluates four behavioral indicators: integrity level escalation (child process running at High or System integrity from a scripting engine parent, suggesting a token swap rather than standard elevation), runas.exe as the parent process for token-based spawning, AdvancedRun.exe presence (tool abused for TrustedInstaller-level execution by WhisperGate), and TrustedInstaller references in command line arguments. A suspicion score aggregates these signals to help analysts prioritize the most likely true positives. The IntegrityLevel field is a native Sysmon EventCode=1 field reflecting the Windows Mandatory Integrity Level of the spawned process.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Software installation tools and MSI packages that legitimately spawn elevated child processes via runas.exe or UAC prompts during setup routines
- System administration scripts that use runas to execute maintenance tasks under alternate credentials as part of a least-privilege administrative workflow
- IT automation platforms (SCCM, Ansible WinRM, PDQ Deploy) that execute tasks as a service account distinct from the initiating agent process
- Security products and EDR agents that intentionally spawn sub-processes under SYSTEM context for real-time monitoring or remediation
- Developer workstations where engineers routinely use runas or IDE-triggered elevation to test code requiring elevated privilege
Other platforms for T1134.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Process Creation via runas with Alternate User Token
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with User=<hostname>\TestUser and IntegrityLevel=Medium, with ParentImage=runas.exe. Security Event 4648 (Explicit credentials used) with TargetUserName=TestUser, ProcessName=C:\Windows\System32\runas.exe, LogonType=9 (NewCredentials). Security Event 4624 (Logon successful) with LogonType=9 for the new TestUser session. Security Event 4672 if TestUser is in any privileged group.
- Test 2AdvancedRun.exe for TrustedInstaller-Level Process Execution
Expected signal: Sysmon Event ID 1 (AdvancedRun.exe launch): Image=AdvancedRun.exe from %TEMP%, IntegrityLevel=Medium. Sysmon Event ID 1 (cmd.exe spawn): Image=cmd.exe, User=NT SERVICE\TrustedInstaller, IntegrityLevel=System, ParentImage=AdvancedRun.exe. Sysmon Event ID 11: file creation at C:\Temp\ti-test.txt by cmd.exe running as TrustedInstaller. Prefetch file created at C:\Windows\Prefetch\ADVANCEDRUN.EXE-*.pf.
- Test 3WTSQueryUserToken Pattern via PowerShell P/Invoke
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with IntegrityLevel=Medium (or System if launched via PsExec -s). PowerShell ScriptBlock Event ID 4104: records the Add-Type definition including 'WTSQueryUserToken' and 'WTSGetActiveConsoleSessionId'. Sysmon Event ID 7 (Image Load): Wtsapi32.dll loaded by powershell.exe — this DLL load by a scripting engine is an anomaly indicator. If running as SYSTEM, Security Event 4624 with LogonType=9 follows the successful token query.
- Test 4Token Theft via PowerShell and CreateProcessAsUser (Invoke-RunAs simulation)
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with the -ExecutionPolicy Bypass flag. PowerShell ScriptBlock Event ID 4104: records the Add-Type definition containing 'OpenProcessToken', 'DuplicateTokenEx', 'CreateProcessWithTokenW'. Sysmon Event ID 7 (Image Load): advapi32.dll invoked via P/Invoke by powershell.exe for token manipulation. If run from elevated context, Security Event 4673 (Sensitive Privilege Use) for SeImpersonatePrivilege use.
References (9)
- https://attack.mitre.org/techniques/T1134/002/
- https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createprocesswithtokenw
- https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessasusera
- https://docs.microsoft.com/en-us/windows/win32/api/wtsapi32/nf-wtsapi32-wtsqueryusertoken
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1134.002/T1134.002.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
- https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/manage/component-updates/command-line-process-auditing
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771525(v=ws.11)
Unlock Pro Content
Get the full detection package for T1134.002 including response playbook, investigation guide, and atomic red team tests.