{"id":"T1134.003","name":"Make and Impersonate Token","url":"https://attack.mitre.org/techniques/T1134/003","tactics":["stealth","privilege-escalation"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0498","stix_id":"x-mitre-detection-strategy--d9cf8032-7b53-4251-8519-a7ccbf6a027a","name":"Behavior‑chain detection for T1134.003 Make and Impersonate Token (Windows)","url":"https://attack.mitre.org/detectionstrategies/DET0498","analytics":[{"id":"AN1375","stix_id":"x-mitre-analytic--6eab700a-548f-48aa-8821-163682fe8bbe","name":"Analytic 1375","description":"A process creates a brand‑new logon session/token (LogonUser*/LsaLogonUser) and then assigns/impersonates it (SetThreadToken/ImpersonateLoggedOnUser) to run actions under that freshly created security context. Chain: (1) suspicious command or script block (e.g., runas /netonly, PowerShell P/Invoke of LogonUser) → (2) ETW/API evidence of LogonUser*/SetThreadToken → (3) Security 4624 New Logon (often LogonType=9 NewCredentials or 2/3 from a non‑interactive parent) with no interactive desktop → (4) sysmon 1 process(es) executing with the new LogonId/SID different from the parent process → (5) optional privileged ops/lateral movement.","url":"https://attack.mitre.org/detectionstrategies/DET0498#AN1375","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Security","channel":"EventCode=4672","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"wineventlog-security"},{"name":"etw:Microsoft-Windows-Security-Auditing","channel":"api_call: LogonUser(A|W), LsaLogonUser, SetThreadToken, ImpersonateLoggedOnUser","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"etw-microsoft-windows-security-auditing"}],"mutable_elements":[{"field":"TimeWindow","description":"Correlation window between LogonUser*/SetThreadToken and the first spawned process (default 5–10 minutes)."},{"field":"SuspiciousLogonTypes","description":"Which 4624 LogonTypes to treat as high risk (e.g., 9 NewCredentials, 3 Network when sourced locally)."},{"field":"AllowedImpersonators","description":"Processes/accounts legitimately creating tokens (e.g., winlogon.exe, lsass.exe, IIS worker, trusted service accounts)."},{"field":"ParentChildUserMismatch","description":"Whether to alert on any SID/LogonId mismatch between parent/child not in allow-list."},{"field":"IntegrityEscalationDelta","description":"Minimum integrity level jump (e.g., Medium→High/System) to raise severity."}],"live":true,"detection_strategies":["DET0498"],"techniques":["T1134.003"]}],"live":true,"version":"1.0","techniques":["T1134.003"]}],"sigma_rules":[{"id":"c7d33b50-f690-4b51-8cfb-0fb912a31e57","title":"HackTool - SharpDPAPI Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2024-06-26","modified":null,"description":"Detects the execution of the SharpDPAPI tool based on CommandLine flags and PE metadata.\nSharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.\n","references":["https://github.com/GhostPack/SharpDPAPI"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1134.001","attack.t1134.003"],"path":"rules/windows/process_creation/proc_creation_win_hktl_sharp_dpapi_execution.yml","techniques":["T1134.001","T1134.003"],"cves":[]},{"id":"cf0c254b-22f1-4b2b-8221-e137b3c0af94","title":"HackTool - Impersonate Execution","author":"Sai Prashanth Pulisetti @pulisettis","status":"test","level":"medium","date":"2022-12-21","modified":"2024-11-23","description":"Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively","references":["https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/","https://github.com/sensepost/impersonate"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1134.001","attack.t1134.003"],"path":"rules/windows/process_creation/proc_creation_win_hktl_impersonate.yml","techniques":["T1134.001","T1134.003"],"cves":[]},{"id":"e3c6d245-7b8f-4e2a-c17f-a9d0e5b38f62","title":"Potentially Suspicious Explicit Credential Local Logon","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2026-07-23","modified":null,"description":"Detects potentially suspicious explicit credential logon events where the user\nis trying to logon with explicit credentials (username and password) that are\ndifferent from the current user context. It might indicate an attacker attempting\nto escalate privileges after obtaining credentials for a different user account.\n","references":["https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648","https://github.com/MSNightmare/LegacyHive"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1134","attack.t1134.003"],"path":"rules/windows/builtin/security/win_security_explicit_credential_local_logon.yml","techniques":["T1134","T1134.003"],"cves":[]},{"id":"f89b08d0-77ad-4728-817b-9b16c5a69c7a","title":"HackTool - SharpImpersonation Execution","author":"Sai Prashanth Pulisetti @pulisettis, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-12-27","modified":"2023-02-13","description":"Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively","references":["https://s3cur3th1ssh1t.github.io/SharpImpersonation-Introduction/","https://github.com/S3cur3Th1sSh1t/SharpImpersonation"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1134.001","attack.t1134.003"],"path":"rules/windows/process_creation/proc_creation_win_hktl_sharp_impersonation.yml","techniques":["T1134.001","T1134.003"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}