T1134 Elastic Security · Elastic

Detect Access Token Manipulation in Elastic Security

Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token. An adversary can use built-in Windows API functions to copy access tokens from existing processes (token stealing) and either apply them to an existing process or spawn a new one. An adversary must already be in a privileged user context to steal a token, but commonly uses token stealing to escalate from administrator to SYSTEM. Any standard user can use the runas command and Windows API functions to create impersonation tokens without administrator access.

MITRE ATT&CK

Tactic
Defense Evasion Privilege Escalation
Technique
T1134 Access Token Manipulation
Canonical reference
https://attack.mitre.org/techniques/T1134/

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by host.name with maxspan=5m
[
  any where
  (
    (
      event.category == "process" and event.type == "start"
      and (
        process.name : ("juicypotato*", "printspoofer*", "sweetpotato*", "godpotato*", "roguewinrm*", "rottenpotatong*", "incognito*", "tokenvator*")
        or process.executable : ("*juicypotato*", "*printspoofer*", "*sweetpotato*", "*godpotato*", "*roguewinrm*", "*rottenpotatong*", "*incognito*", "*tokenvator*")
        or process.command_line : ("*juicypotato*", "*printspoofer*", "*sweetpotato*", "*godpotato*", "*roguewinrm*", "*incognito*", "*tokenvator*")
      )
    )
    or
    (
      event.category == "process" and event.type == "start"
      and process.name : ("powershell.exe", "pwsh.exe")
      and process.command_line : (
        "*Invoke-TokenManipulation*", "*Get-SecurityToken*", "*DuplicateTokenEx*",
        "*OpenProcessToken*", "*AdjustTokenPrivileges*", "*CreateProcessWithToken*",
        "*ImpersonateLoggedOnUser*", "*SetThreadToken*", "*NtImpersonateThread*",
        "*Invoke-RunAs*", "*SeDebugPrivilege*", "*SeAssignPrimaryTokenPrivilege*",
        "*SeTcbPrivilege*", "*SeCreateTokenPrivilege*"
      )
    )
    or
    (
      event.category == "authentication"
      and event.code == "4672"
      and not user.name : ("*$", "SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE", "DWM-1", "DWM-2", "DWM-3", "UMFD-0", "UMFD-1")
      and winlog.event_data.PrivilegeList : ("*SeDebugPrivilege*", "*SeAssignPrimaryTokenPrivilege*", "*SeTcbPrivilege*", "*SeCreateTokenPrivilege*")
    )
  )
]
high severity high confidence

Detects Windows access token manipulation via three vectors: (1) execution of known token abuse tools such as JuicyPotato, PrintSpoofer, SweetPotato, and GodPotato; (2) PowerShell invoking token manipulation APIs or privilege escalation frameworks; (3) suspicious special privilege assignment (Event ID 4672) to non-service, non-system accounts including SeDebugPrivilege and SeAssignPrimaryTokenPrivilege.

Data Sources

Windows Security Event LogSysmonElastic Endpoint

Required Tables

logs-endpoint.events.process-*logs-system.security-*winlogbeat-*

False Positives & Tuning

  • Legitimate privileged administrator accounts (e.g., SQL Server service accounts, backup agents) that genuinely require SeDebugPrivilege or SeAssignPrimaryTokenPrivilege will trigger the Event 4672 branch — tune by excluding known service account names.
  • Security testing tools and red team exercises using Invoke-TokenManipulation from PowerShell Empire or similar frameworks during authorized penetration tests.
  • Certain EDR and DLP agents that inject into processes or require token duplication for inline inspection may trigger process-level token API detections.
Download portable Sigma rule (.yml)

Other platforms for T1134

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Invoke-TokenManipulation via PowerSploit

    Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Invoke-TokenManipulation' and 'Net.WebClient'. Sysmon Event ID 3: Network connection to raw.githubusercontent.com. PowerShell ScriptBlock Log Event ID 4104 with the full Invoke-TokenManipulation script content after download. Security Event 4672 may fire if the token enumeration triggers a privilege check.

  2. Test 2AdjustTokenPrivileges — Enable SeDebugPrivilege via PowerShell

    Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'AdjustTokenPrivileges', 'OpenProcessToken', 'LookupPrivilegeValue', and 'SeDebugPrivilege'. PowerShell ScriptBlock Log Event ID 4104 with the P/Invoke code. Security Event 4672 may fire once the privilege adjustment is applied to the current process token.

  3. Test 3PrintSpoofer — SeImpersonatePrivilege Abuse to SYSTEM

    Expected signal: Sysmon Event ID 1: Process Create for PrintSpoofer64.exe with CommandLine '-i -c whoami'. Sysmon Event ID 1: Child process cmd.exe or whoami.exe spawned from PrintSpoofer64.exe running as NT AUTHORITY\SYSTEM. System Event 7045 (Service Control Manager): a transient service briefly installed by PrintSpoofer to coerce the spooler token. Sysmon Event ID 3: Named pipe connection from PrintSpoofer to the spooler pipe.

  4. Test 4RunAs with Explicit Credentials — Token Creation via LogonUser

    Expected signal: Security Event 4648: Logon Using Explicit Credentials — records the calling process (cmd.exe), the target account (testuser), and the logon GUID. Security Event 4624: New Logon with LogonType=2 (interactive) for the new session. Sysmon Event ID 1: cmd.exe spawned with runas as parent, running in the context of testuser. Security Event 4672 if testuser holds special privileges.

Last updated: 2026-04-18 Research depth: deep
References (12)

Unlock Pro Content

Get the full detection package for T1134 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Sub-techniques (5)

Related Techniques

T1134.001Token Impersonation/TheftT1134.002Create Process with TokenT1134.003Make and Impersonate TokenT1134.004Parent PID SpoofingT1134.005SID-History InjectionT1055Process InjectionT1003OS Credential DumpingT1548.002Bypass User Account ControlT1068Exploitation for Privilege EscalationT1078Valid Accounts

Same Tactic: Defense Evasion

Popular Detections