Access Token Manipulation: Make and Impersonate Token
- ID
- T1134.003
- Tactics
- TA0004 Privilege Escalation, TA0005 Stealth
- Sub-technique of
- T1134 Access Token Manipulation
- Platforms
- Windows
- Data sources
- Process Creation, Logon Session Metadata, OS API Execution
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the LogonUser function.[4] The function will return a copy of the new session's access token and the adversary can use SetThreadToken to assign the token to a thread.
This behavior is distinct from Token Impersonation/Theft in that this refers to creating a new user token instead of stealing or duplicating an existing one.
Detection
- DET0498 Behavior‑chain detection for T1134.003 Make and Impersonate Token (Windows)
Data components: Process Creation, Logon Session Metadata, OS API Execution
Mitigations (2)
- M1018 User Account Management
An adversary must already have administrator level access on the local system to make full use of this technique; be sure to restrict users and accounts to the least privileges they require.
- M1026 Privileged Account Management
Limit permissions so that users and user groups cannot create tokens. This setting should be defined for the local system account only. GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Create a token object. [1] Also define who can create a process level token to only the local and network service through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Replace a process level token.[2]
Administrators should log in as a standard user but run their tools with administrator privileges using the built-in access token manipulation command
runas.[3]
Groups (2)
Software (3)
References
- Microsoft Create Token
- Microsoft Replace Process Token
- Microsoft runas
- LogonUserW function