MITRE ATT&CKsub-technique

T1134.002 Create Process with Token

Published 2020-02-18 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Stealth, Privilege Escalation
Platforms
Windows
Version
2.0
Created
2020-02-18

Description

Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as CreateProcessWithTokenW and runas. Creating processes with a token not associated with the current user may require the credentials of the target user, specific privileges to impersonate that user, or access to the token to be used. For example, the token could be duplicated via Token Impersonation/Theft or created via Make and Impersonate Token before being used to create a process. While this technique is distinct from Token Impersonation/Theft, the techniques can be used in conjunction where a token is duplicated and then used to create a new process.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1134 Access Token Manipulation technique

Tactic · MITRE ATT&CK (2)

Referenced by MITRE ATT&CK · mitigates (2)

  • M1018 User Account Management mitigation
  • M1026 Privileged Account Management mitigation

Referenced by MITRE ATT&CK · uses (14)

  • S9052 MiniFast software (malware)
  • S1239 TONESHELL software (malware)
  • S0689 WhisperGate software (malware)
  • S0501 PipeMon software (malware)
  • S0496 REvil software (malware)
  • S0456 Aria-body software (malware)
  • S0412 ZxShell software (malware)
  • S0378 PoshC2 software (tool)
  • S0363 Empire software (tool)
  • S0356 KONNI software (malware)
  • S0344 Azorult software (malware)
  • S0239 Bankshot software (malware)
  • G0010 Turla group
  • G0032 Lazarus Group group

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-196 Session Credential Falsification through Forging attack pattern

Referenced by Compliance · mitigates (8)

  • CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control

References