CyberStack

MITRE ATT&CK / Techniques / T1134.001

Access Token Manipulation: Token Impersonation/Theft

ID
T1134.001
Tactics
TA0004 Privilege Escalation, TA0005 Stealth
Sub-technique of
T1134 Access Token Manipulation
Platforms
Windows
Data sources
Process Creation, Process Access, OS API Execution
Source
attack.mitre.org
MITRE last modified
12 May 2026

Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using DuplicateToken or DuplicateTokenEx.[4] The token can then be used with ImpersonateLoggedOnUser to allow the calling thread to impersonate a logged on user's security context, or with SetThreadToken to assign the impersonated token to a thread.

An adversary may perform Token Impersonation/Theft when they have a specific, existing process they want to assign the duplicated token to. For example, this may be useful for when the target user has a non-network logon session on the system.

When an adversary would instead use a duplicated token to create a new process rather than attaching to an existing process, they can additionally Create Process with Token using CreateProcessWithTokenW or CreateProcessAsUserW. Token Impersonation/Theft is also distinct from Make and Impersonate Token in that it refers to duplicating an existing token, rather than creating a new one.

Detection

Mitigations (2)

M1018 User Account Management

An adversary must already have administrator level access on the local system to make full use of this technique; be sure to restrict users and accounts to the least privileges they require.

M1026 Privileged Account Management

Limit permissions so that users and user groups cannot create tokens. This setting should be defined for the local system account only. GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Create a token object. [1] Also define who can create a process level token to only the local and network service through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Replace a process level token.[2]

Administrators should log in as a standard user but run their tools with administrator privileges using the built-in access token manipulation command runas.[3]

Groups (2)

Software (18)

References

  1. Microsoft Create Token
  2. Microsoft Replace Process Token
  3. Microsoft runas
  4. DuplicateToken function