Detect Create Process with Token in Sumo Logic CSE
Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as CreateProcessWithTokenW, CreateProcessAsUser, and runas. Creating processes with a token not associated with the current user may require the credentials of the target user, specific privileges to impersonate that user, or access to the token to be used. The token could be duplicated via Token Impersonation/Theft (T1134.001) or created via Make and Impersonate Token (T1134.003) before being used to create a new process. This technique has been observed in campaigns by Turla, Lazarus Group, KONNI, Azorult, Bankshot, REvil, WhisperGate, and Empire post-exploitation frameworks.
MITRE ATT&CK
- Technique
- T1134 Access Token Manipulation
- Sub-technique
- T1134.002 Create Process with Token
- Canonical reference
- https://attack.mitre.org/techniques/T1134/002/
Sumo Detection Query
_sourceCategory=*windows* OR _sourceCategory=*sysmon* OR _sourceCategory=*endpoint*
| where (%"EventID" = "1" OR %"event_id" = "1" OR %"EventCode" = "1" OR %"EventID" = "4688" OR %"event_id" = "4688")
| parse field=%"Image" "*\\*" as image_path, image_name nodrop
| parse field=%"ParentImage" "*\\*" as parent_path, parent_name nodrop
| parse field=%"NewProcessName" "*\\*" as new_proc_path, new_proc_name nodrop
| parse field=%"ParentProcessName" "*\\*" as parent_proc_path, parent_proc_name nodrop
| if (!isEmpty(image_name), image_name, new_proc_name) as process_name
| if (!isEmpty(parent_name), parent_name, parent_proc_name) as parent_process_name
| toLowerCase(process_name) as process_name_lower
| toLowerCase(parent_process_name) as parent_name_lower
| toLowerCase(%"CommandLine") as cmdline_lower
| toLowerCase(%"ParentCommandLine") as parent_cmdline_lower
| toLowerCase(%"IntegrityLevel") as integrity_lower
| eval integrity_escalation = if(
(integrity_lower = "high" or integrity_lower = "system") and
(
parent_name_lower matches "*cmd.exe" or
parent_name_lower matches "*powershell.exe" or
parent_name_lower matches "*pwsh.exe" or
parent_name_lower matches "*wscript.exe" or
parent_name_lower matches "*cscript.exe" or
parent_name_lower matches "*mshta.exe" or
parent_name_lower matches "*rundll32.exe" or
parent_name_lower matches "*regsvr32.exe" or
parent_name_lower matches "*wmic.exe"
) and
!(process_name_lower matches "*consent.exe" or process_name_lower matches "*werfault.exe" or process_name_lower matches "*dllhost.exe")
, 1, 0)
| eval runas_parent = if(
parent_name_lower matches "*runas.exe" and
!(process_name_lower matches "*consent.exe" or process_name_lower matches "*werfault.exe")
, 1, 0)
| eval advancedrun_tool = if(
process_name_lower matches "*advancedrun.exe" or
parent_name_lower matches "*advancedrun.exe"
, 1, 0)
| eval trustedinstaller_abuse = if(
(cmdline_lower matches "*trustedinstaller*" or parent_cmdline_lower matches "*trustedinstaller*")
, 1, 0)
| eval suspicion_score = integrity_escalation + runas_parent + advancedrun_tool + trustedinstaller_abuse
| where suspicion_score > 0
| fields _messageTime, _sourceHost, %"User", process_name, %"CommandLine", parent_process_name, %"ParentCommandLine", integrity_lower, integrity_escalation, runas_parent, advancedrun_tool, trustedinstaller_abuse, suspicion_score
| sort by _messageTime descDetects token-based process creation (T1134.002) in Sumo Logic by analyzing Sysmon Event ID 1 and Security Event 4688 for integrity level escalation from scripting engines, runas.exe parent chains, AdvancedRun.exe usage, and TrustedInstaller command-line references with a composite suspicion score.
Data Sources
Required Tables
False Positives & Tuning
- Enterprise software such as PDQ Deploy, Chocolatey, or similar tools that use elevated scripting wrappers to manage installations may trigger integrity escalation detections during scheduled maintenance windows.
- Security operations teams performing authorized red team exercises or penetration tests using runas.exe or Empire/Metasploit token impersonation modules.
- Third-party IT management platforms (Kaseya, ConnectWise) that spawn elevated helper processes from scripting engine parents as part of remote management workflows.
Other platforms for T1134.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Process Creation via runas with Alternate User Token
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with User=<hostname>\TestUser and IntegrityLevel=Medium, with ParentImage=runas.exe. Security Event 4648 (Explicit credentials used) with TargetUserName=TestUser, ProcessName=C:\Windows\System32\runas.exe, LogonType=9 (NewCredentials). Security Event 4624 (Logon successful) with LogonType=9 for the new TestUser session. Security Event 4672 if TestUser is in any privileged group.
- Test 2AdvancedRun.exe for TrustedInstaller-Level Process Execution
Expected signal: Sysmon Event ID 1 (AdvancedRun.exe launch): Image=AdvancedRun.exe from %TEMP%, IntegrityLevel=Medium. Sysmon Event ID 1 (cmd.exe spawn): Image=cmd.exe, User=NT SERVICE\TrustedInstaller, IntegrityLevel=System, ParentImage=AdvancedRun.exe. Sysmon Event ID 11: file creation at C:\Temp\ti-test.txt by cmd.exe running as TrustedInstaller. Prefetch file created at C:\Windows\Prefetch\ADVANCEDRUN.EXE-*.pf.
- Test 3WTSQueryUserToken Pattern via PowerShell P/Invoke
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with IntegrityLevel=Medium (or System if launched via PsExec -s). PowerShell ScriptBlock Event ID 4104: records the Add-Type definition including 'WTSQueryUserToken' and 'WTSGetActiveConsoleSessionId'. Sysmon Event ID 7 (Image Load): Wtsapi32.dll loaded by powershell.exe — this DLL load by a scripting engine is an anomaly indicator. If running as SYSTEM, Security Event 4624 with LogonType=9 follows the successful token query.
- Test 4Token Theft via PowerShell and CreateProcessAsUser (Invoke-RunAs simulation)
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with the -ExecutionPolicy Bypass flag. PowerShell ScriptBlock Event ID 4104: records the Add-Type definition containing 'OpenProcessToken', 'DuplicateTokenEx', 'CreateProcessWithTokenW'. Sysmon Event ID 7 (Image Load): advapi32.dll invoked via P/Invoke by powershell.exe for token manipulation. If run from elevated context, Security Event 4673 (Sensitive Privilege Use) for SeImpersonatePrivilege use.
References (9)
- https://attack.mitre.org/techniques/T1134/002/
- https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createprocesswithtokenw
- https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessasusera
- https://docs.microsoft.com/en-us/windows/win32/api/wtsapi32/nf-wtsapi32-wtsqueryusertoken
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1134.002/T1134.002.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
- https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/manage/component-updates/command-line-process-auditing
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771525(v=ws.11)
Unlock Pro Content
Get the full detection package for T1134.002 including response playbook, investigation guide, and atomic red team tests.