ATT&CK coverage › Technique

Access Token Manipulation: Make and Impersonate Token T1134.003

Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function. The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread.

Events covered

2 catalog events are tagged with this technique by at least one rule.

ProviderEvent IDTitle
Sysmon1Process creation
Security-Auditing4624An account was successfully logged on.

Authoring guide

Patterns shared across the 4 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (11 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
CommandLine3match 3 exec , impersonate.exe, adduser , /file:, masterkeys
Image2ends_with 2\SharpDPAPI.exe, \SharpImpersonation.exe
OriginalFileName2eq 2SharpDPAPI.exe, SharpImpersonation.exe
EventType1eq 1logged-in
LogonProcessName1starts_with 1seclogo
process_name1eq 1svchost.exe
user.id1starts_with 1S-1-12-1-, S-1-5-21-
event.outcome1eq 1success
event.type1eq 1start
source.ip1eq 1::1
Hashes1match 1IMPHASH=0A358FFC1697B7A07D0E817AC740DF62, MD5=9520714AB576B0ED01D1513691377D01, SHA256=E81CC96E2118DC4FBFE5BAD1604E0AC7681960143E2101E1A0...

Top indicator values (42 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.

FieldKindValueRules (here)Corpus reach
user.idstarts_withS-1-12-1-1
EventTypeeqlogged-in17
event.typeeqstart1
event.outcomeeqsuccess18
user.idstarts_withS-1-5-21-1
LogonProcessNamestarts_withseclogo1
source.ipeq::11
process_nameeqsvchost.exe1
CommandLinematch list 12
CommandLinematch exec 12
CommandLinematchimpersonate.exe1
CommandLinematch adduser 1
HashesmatchMD5=9520714AB576B0ED01D1513691377D011
HashesmatchSHA256=E81CC96E2118DC4FBFE5BAD1604E0AC7681960143E2101E1A024D52264BB0A8A1
HashesmatchIMPHASH=0A358FFC1697B7A07D0E817AC740DF621
CommandLinematch}:1
CommandLinematch rdg 1
CommandLinematch keepass 1
CommandLinematch backupkey 1
CommandLinematch certificates 1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 3 rules

Elastic 1 rule