Access Token Manipulation

What is Access Token Manipulation?

“Access Token Manipulation is documented as technique T1134 in MITRE ATT&CK® v19.1 under the Privilege Escalation tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Access Token Manipulation activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for Windows API calls associated with token manipulation including OpenProcessToken, DuplicateToken, ImpersonateLoggedOnUser, and CreateProcessWithTokenW, particularly from processes with no legitimate reason to perform token operations.

2. 2

   Alert on processes running under a different user context than expected based on their process ancestry, as token manipulation often results in processes appearing to belong to privileged accounts while descending from unprivileged processes.

3. 3

   Detect SeImpersonatePrivilege and SeAssignPrimaryTokenPrivilege being exercised by service accounts or standard users, as these privileges are not normally used in day-to-day operations and their use warrants investigation.

4. 4

   Monitor for parent process ID spoofing by correlating reported parent PIDs with actual process ancestry, as attackers use this technique to make malicious processes appear to be children of trusted processes.

5. 5

   Track unusual service account activity following periods of interactive session establishment, as attackers may use token impersonation to pivot from interactive sessions to service account contexts for lateral movement.

Example Alerts

These realistic alert examples show what Access Token Manipulation looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Access Token Manipulation?

Detection centers on XDR, SIEM telemetry for the privilege escalation phase of the attack. Monitor for Windows API calls associated with token manipulation including OpenProcessToken, DuplicateToken, ImpersonateLoggedOnUser, and CreateProcessWithTokenW, particularly from processes with no legitimate reason to perform token operations. Alert on processes running under a different user context than expected based on their process ancestry, as token manipulation often results in processes appearing to belong to privileged accounts while descending from unprivileged processes.

What does a Access Token Manipulation alert look like?

A representative XDR detection is "Token Impersonation via SeImpersonatePrivilege" (critical severity): Metasploit Meterpreter pattern detected: process executing in SYSTEM context via token impersonation using a named pipe exploit. The attack exploited a vulnerable service with SeImpersonatePrivilege to intercept a SYSTEM token through a named pipe connection. This technique, known as Potato attack variants, is frequently used to escalate from service account to SYSTEM privileges.

Which tools detect Access Token Manipulation, and how can I practice?

Access Token Manipulation (T1134) is best surfaced with XDR, SIEM telemetry, which exposes the privilege escalation signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.