Detect Access Token Manipulation in Microsoft Sentinel
Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token. An adversary can use built-in Windows API functions to copy access tokens from existing processes (token stealing) and either apply them to an existing process or spawn a new one. An adversary must already be in a privileged user context to steal a token, but commonly uses token stealing to escalate from administrator to SYSTEM. Any standard user can use the runas command and Windows API functions to create impersonation tokens without administrator access.
MITRE ATT&CK
- Technique
- T1134 Access Token Manipulation
- Canonical reference
- https://attack.mitre.org/techniques/T1134/
KQL Detection Query
let KnownTokenTools = dynamic([
"juicypotato", "printspoofer", "sweetpotato", "godpotato",
"roguewinrm", "rottenpotatong", "incognito", "tokenvator"
]);
let TokenManipulationAPIs = dynamic([
"Invoke-TokenManipulation", "Get-SecurityToken", "DuplicateTokenEx",
"OpenProcessToken", "AdjustTokenPrivileges", "CreateProcessWithToken",
"ImpersonateLoggedOnUser", "SetThreadToken", "LogonUserW", "LogonUserA",
"NtImpersonateThread", "Invoke-RunAs"
]);
let SuspiciousPrivileges = dynamic([
"SeDebugPrivilege", "SeAssignPrimaryTokenPrivilege",
"SeTcbPrivilege", "SeCreateTokenPrivilege"
]);
// Branch 1: Known token manipulation utilities
let KnownTools = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any (KnownTokenTools)
or FolderPath has_any (KnownTokenTools)
or ProcessCommandLine has_any (KnownTokenTools)
| extend DetectionType = "KnownTokenTool"
| extend IsPotatoFamily = ProcessCommandLine has_any ("juicypotato", "printspoofer", "sweetpotato", "godpotato")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
InitiatingProcessAccountName, DetectionType, IsPotatoFamily;
// Branch 2: PowerShell invoking token manipulation APIs or frameworks
let PSTokenAbuse = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (TokenManipulationAPIs)
or ProcessCommandLine has_any (SuspiciousPrivileges)
| extend DetectionType = "PowerShellTokenAbuse"
| extend IsPotatoFamily = false
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
InitiatingProcessAccountName, DetectionType, IsPotatoFamily;
// Branch 3: Suspicious special privileges assigned to non-service user logon sessions
let PrivilegeEscalation = SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4672
| where SubjectUserName !endswith "$"
| where SubjectUserName !in~ ("SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE",
"DWM-1", "DWM-2", "DWM-3", "UMFD-0", "UMFD-1")
| where PrivilegeList has "SeDebugPrivilege"
or PrivilegeList has "SeAssignPrimaryTokenPrivilege"
or PrivilegeList has "SeTcbPrivilege"
or PrivilegeList has "SeCreateTokenPrivilege"
| extend DetectionType = "SuspiciousPrivilegeAssignment"
| extend IsPotatoFamily = false
| project Timestamp=TimeGenerated, DeviceName=Computer, AccountName=SubjectUserName,
FileName="Security Event 4672", ProcessCommandLine=PrivilegeList,
InitiatingProcessFileName="N/A",
InitiatingProcessCommandLine=tostring(SubjectLogonId),
InitiatingProcessAccountName="N/A", DetectionType, IsPotatoFamily;
union KnownTools, PSTokenAbuse, PrivilegeEscalation
| sort by Timestamp descDetects Access Token Manipulation using three behavioral branches. Branch 1 identifies known token theft utilities (JuicyPotato, PrintSpoofer, SweetPotato, GodPotato, Incognito) by process name or command line. Branch 2 identifies PowerShell invoking token manipulation APIs (DuplicateTokenEx, OpenProcessToken, AdjustTokenPrivileges, CreateProcessWithToken, ImpersonateLoggedOnUser) or frameworks like PowerSploit's Invoke-TokenManipulation. Branch 3 monitors Security Event ID 4672 for non-service accounts receiving high-risk privileges (SeDebugPrivilege, SeAssignPrimaryTokenPrivilege, SeTcbPrivilege) that are commonly abused to steal or forge tokens.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate penetration testing tools or red team exercises using Invoke-TokenManipulation or JuicyPotato on authorized engagements
- System administrators using runas or token manipulation for legitimate privileged tasks with corresponding change tickets
- Security software (EDR agents, vulnerability scanners, PAM solutions) that legitimately hold SeDebugPrivilege for process inspection
- Windows services running as NETWORK SERVICE or LOCAL SERVICE that receive SeImpersonatePrivilege by design (IIS application pools, SQL Server, etc.)
- Domain controllers where SeDebugPrivilege is legitimately assigned to elevated administrator accounts
Other platforms for T1134
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Invoke-TokenManipulation via PowerSploit
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Invoke-TokenManipulation' and 'Net.WebClient'. Sysmon Event ID 3: Network connection to raw.githubusercontent.com. PowerShell ScriptBlock Log Event ID 4104 with the full Invoke-TokenManipulation script content after download. Security Event 4672 may fire if the token enumeration triggers a privilege check.
- Test 2AdjustTokenPrivileges — Enable SeDebugPrivilege via PowerShell
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'AdjustTokenPrivileges', 'OpenProcessToken', 'LookupPrivilegeValue', and 'SeDebugPrivilege'. PowerShell ScriptBlock Log Event ID 4104 with the P/Invoke code. Security Event 4672 may fire once the privilege adjustment is applied to the current process token.
- Test 3PrintSpoofer — SeImpersonatePrivilege Abuse to SYSTEM
Expected signal: Sysmon Event ID 1: Process Create for PrintSpoofer64.exe with CommandLine '-i -c whoami'. Sysmon Event ID 1: Child process cmd.exe or whoami.exe spawned from PrintSpoofer64.exe running as NT AUTHORITY\SYSTEM. System Event 7045 (Service Control Manager): a transient service briefly installed by PrintSpoofer to coerce the spooler token. Sysmon Event ID 3: Named pipe connection from PrintSpoofer to the spooler pipe.
- Test 4RunAs with Explicit Credentials — Token Creation via LogonUser
Expected signal: Security Event 4648: Logon Using Explicit Credentials — records the calling process (cmd.exe), the target account (testuser), and the logon GUID. Security Event 4624: New Logon with LogonType=2 (interactive) for the new session. Sysmon Event ID 1: cmd.exe spawned with runas as parent, running in the context of testuser. Security Event 4672 if testuser holds special privileges.
References (12)
- https://attack.mitre.org/techniques/T1134/
- https://pentestlab.blog/2017/04/03/token-manipulation/
- https://www.blackhat.com/docs/eu-17/materials/eu-17-Atkinson-A-Process-Is-No-One-Hunting-For-Token-Manipulation.pdf
- https://learn.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-adjusttokenprivileges
- https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-openprocesstoken
- https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createprocesswithtokenw
- https://github.com/itm4n/PrintSpoofer
- https://github.com/ohpe/juicy-potato
- https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Invoke-TokenManipulation.ps1
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1134/T1134.md
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://learn.microsoft.com/en-us/azure/sentinel/understand-threat-intelligence
Unlock Pro Content
Get the full detection package for T1134 including response playbook, investigation guide, and atomic red team tests.