{"id":"T1134.002","name":"Create Process with Token","url":"https://attack.mitre.org/techniques/T1134/002","tactics":["stealth","privilege-escalation"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0456","stix_id":"x-mitre-detection-strategy--78aa8d17-c96f-4ba9-b431-f91157f38553","name":"Behavior-chain detection for T1134.002 Create Process with Token (Windows)","url":"https://attack.mitre.org/detectionstrategies/DET0456","analytics":[{"id":"AN1253","stix_id":"x-mitre-analytic--0929e9c5-2e1a-4cc1-a9c5-df081b180201","name":"Analytic 1253","description":"A process (often after stealing/creating a token) calls CreateProcessWithTokenW/CreateProcessAsUserW or uses runas to spawn a **new** process whose security context (SID/LogonId/IntegrityLevel) differs from its parent. Chain: (1) suspicious command/API → (2) privileged handle or token duplication/open → (3) new child process running as another user / higher integrity → (4) optional follow‑on privileged/lateral actions.","url":"https://attack.mitre.org/detectionstrategies/DET0456#AN1253","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"},{"name":"ETW:ProcThread","channel":"api_call: CreateProcessWithTokenW, CreateProcessAsUserW","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"etw-procthread"},{"name":"WinEventLog:Security","channel":"EventCode=4672, 4634","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Security","channel":"EventCode=5136","data_component":"DC0066","data_component_name":"Active Directory Object Modification","log_source_slug":"wineventlog-security"}],"mutable_elements":[{"field":"TimeWindow","description":"Correlation window between API/handle access and the spawned process (default 5–10 minutes)."},{"field":"AllowedImpersonators","description":"Service accounts/binaries legitimately using CreateProcessWithTokenW (e.g., PsExec service, SCCM, backup agents)."},{"field":"IntegrityEscalationDelta","description":"Minimum jump in integrity level (e.g., Medium→System) to flag."},{"field":"ParentChildUserMismatch","description":"Treat any parent/child SID or LogonId mismatch as suspicious unless on allow-list."},{"field":"SensitiveTargets","description":"List of processes (e.g., lsass.exe, winlogon.exe, services.exe) whose token access prior to the spawn raises score."}],"live":true,"detection_strategies":["DET0456"],"techniques":["T1134.002"]}],"live":true,"version":"1.0","techniques":["T1134.002"]}],"sigma_rules":[{"id":"15619216-e993-4721-b590-4c520615a67d","title":"Potential Meterpreter/CobaltStrike Activity","author":"Teymur Kheirkhabarov, Ecco, Florian Roth","status":"test","level":"high","date":"2019-10-26","modified":"2023-02-05","description":"Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting","references":["https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment","https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1134.001","attack.t1134.002"],"path":"rules/windows/process_creation/proc_creation_win_hktl_meterpreter_getsystem.yml","techniques":["T1134.001","T1134.002"],"cves":[]},{"id":"2ad78473-6978-40f5-b8f1-89c7e1c27a1a","title":"RedSun - Conhost.exe Spawned by TieringEngineService.exe","author":"Swachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost","status":"experimental","level":"high","date":"2026-04-17","modified":null,"description":"Detects two stages of the RedSun post-exploitation process chain that deliver a SYSTEM-level shell to the attacker's interactive session.\nObserved process chain\n  services.exe\n    → TieringEngineService.exe\n      → conhost.exe             (SYSTEM, CommandLine: bare path, no arguments)\n        → cmd.exe / shell       (SYSTEM, TerminalSessionId = attacker's session)\n\nStage 1 — TieringEngineService.exe spawns argument-less conhost.exe:\n  After winning the oplock + Cloud Files mount point race, the malicious TieringEngineService.exe (RedSun.exe copied to System32, started via CoCreateInstance\n  / services.exe) detects it is NT AUTHORITY\\SYSTEM and calls LaunchConsoleInSessionId().\n  This opens \\\\.\\pipe\\REDSUN, reads the attacker's session ID, duplicates the SYSTEM token, re-stamps it with that session ID via SetTokenInformation(TokenSessionId), then\n  calls CreateProcessAsUser to spawn conhost.exe with no arguments.\n\nStage 2 — Shell spawned from rogue conhost.exe (EDR sources with GrandParentImage):\n  The rogue SYSTEM conhost.exe spawns a shell (cmd.exe, PowerShell, etc.) as SYSTEM in the attacker's interactive session.\n  On EDR sources that expose GrandParentImage, the full three-level chain (TieringEngineService.exe → conhost.exe → shell) can be matched directly.\n  The legitimate TieringEngineService.exe is a headless COM server that is unlikely to spawn conhost.exe under normal conditions.\n","references":["https://github.com/Nightmare-Eclipse/RedSun"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1134.002","attack.t1036.005","detection.emerging-threats"],"path":"rules-emerging-threats/2026/Exploits/RedSun/proc_creation_win_redsun_conhost_via_tiering_engine.yml","techniques":["T1134.002","T1036.005"],"cves":[]},{"id":"590a5f4c-6c8c-4f10-8307-89afe9453a9d","title":"Suspicious Child Process Created as System","author":"Teymur Kheirkhabarov, Roberto Rodriguez (@Cyb3rWard0g), Open Threat Research (OTR)","status":"test","level":"high","date":"2019-10-26","modified":"2024-12-01","description":"Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts","references":["https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment","https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/","https://github.com/antonioCoco/RogueWinRM","https://twitter.com/Cyb3rWard0g/status/1453123054243024897"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1134.002"],"path":"rules/windows/process_creation/proc_creation_win_susp_child_process_as_system_.yml","techniques":["T1134.002"],"cves":[]},{"id":"843544a7-56e0-4dcc-a44f-5cc266dd97d6","title":"Meterpreter or Cobalt Strike Getsystem Service Installation - System","author":"Teymur Kheirkhabarov, Ecco, Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2019-10-26","modified":"2023-11-15","description":"Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation","references":["https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment","https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/"],"logsource":{"product":"windows","service":"system"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1134.001","attack.t1134.002"],"path":"rules/windows/builtin/system/service_control_manager/win_system_meterpreter_or_cobaltstrike_getsystem_service_installation.yml","techniques":["T1134.001","T1134.002"],"cves":[]},{"id":"d2b749ee-4225-417e-b20e-a8d2193cbb84","title":"PUA - AdvancedRun Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2022-01-20","modified":"2023-02-21","description":"Detects the execution of AdvancedRun utility","references":["https://twitter.com/splinter_code/status/1483815103279603714","https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3","https://www.elastic.co/security-labs/operation-bleeding-bear","https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.privilege-escalation","attack.stealth","attack.t1564.003","attack.t1134.002","attack.t1059.003"],"path":"rules/windows/process_creation/proc_creation_win_pua_advancedrun.yml","techniques":["T1564.003","T1134.002","T1059.003"],"cves":[]},{"id":"ecbc5e16-58e0-4521-9c60-eb9a7ea4ad34","title":"Meterpreter or Cobalt Strike Getsystem Service Installation - Security","author":"Teymur Kheirkhabarov, Ecco, Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2019-10-26","modified":"2023-11-15","description":"Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation","references":["https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment","https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1134.001","attack.t1134.002"],"path":"rules/windows/builtin/security/win_security_meterpreter_or_cobaltstrike_getsystem_service_install.yml","techniques":["T1134.001","T1134.002"],"cves":[]},{"id":"fa00b701-44c6-4679-994d-5a18afa8a707","title":"PUA - AdvancedRun Suspicious Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-01-20","modified":"2023-02-21","description":"Detects the execution of AdvancedRun utility in the context of the TrustedInstaller, SYSTEM, Local Service or Network Service accounts","references":["https://twitter.com/splinter_code/status/1483815103279603714","https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3","https://www.elastic.co/security-labs/operation-bleeding-bear","https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1134.002"],"path":"rules/windows/process_creation/proc_creation_win_pua_advancedrun_priv_user.yml","techniques":["T1134.002"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}