Techniques › T1134 › T1134.003
T1134.003 Make and Impersonate Token
stealth · privilege escalation — Windows · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
4
Sigma rules tagged attack.t1134.003
0
KEV CVEs mapped here
<p>Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the
LogonUser function. The function will return a copy of the new session's access token and the adversary can use SetThreadToken to assign the token to a thread.</p><p>This behavior is distinct from Token Impersonation/Theft in that this refers to creating a new user token instead of stealing or duplicating an existing one.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0498 Behavior‑chain detection for T1134.003 Make and Impersonate Token (Windows) v1.0
AN1375 WindowsA process creates a brand‑new logon session/token (LogonUser*/LsaLogonUser) and then assigns/impersonates it (SetThreadToken/ImpersonateLoggedOnUser) to run actions under that freshly created security context. Chain: (1) suspicious command or script block (e.g., runas /netonly, PowerShell P/Invoke of LogonUser) → (2) ETW/API evidence of LogonUser*/SetThreadToken → (3) Security 4624 New Logon (often LogonType=9 NewCredentials or 2/3 from a non‑interactive parent) with no interactive desktop → (4) sysmon 1 process(es) executing with the new LogonId/SID different from the parent process → (5) optional privileged ops/lateral movement.etw:Microsoft-Windows-Security-Auditing
api_call: LogonUser(A|W), LsaLogonUser, SetThreadToken, ImpersonateLoggedOnUser→ DC0021 OS API ExecutionTunable:TimeWindowSuspiciousLogonTypesAllowedImpersonatorsParentChildUserMismatchIntegrityEscalationDelta
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1134.003
Author: Nasreddine Bencherchali (Nextron Systems)
· 2024-06-26 · logsource: product=windows category=process_creation · c7d33b50-f690-4b51-8cfb-0fb912a31e57
Detects the execution of the SharpDPAPI tool based on CommandLine flags and PE metadata.
SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.
Author: Sai Prashanth Pulisetti @pulisettis
· 2022-12-21 (modified 2024-11-23) · logsource: product=windows category=process_creation · cf0c254b-22f1-4b2b-8221-e137b3c0af94
Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-07-23 · logsource: product=windows service=security · e3c6d245-7b8f-4e2a-c17f-a9d0e5b38f62
Detects potentially suspicious explicit credential logon events where the user
is trying to logon with explicit credentials (username and password) that are
different from the current user context. It might indicate an attacker attempting
to escalate privileges after obtaining credentials for a different user account.
Author: Sai Prashanth Pulisetti @pulisettis, Nasreddine Bencherchali (Nextron Systems)
· 2022-12-27 (modified 2023-02-13) · logsource: product=windows category=process_creation · f89b08d0-77ad-4728-817b-9b16c5a69c7a
Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively
Rules tagged at the parent level (attack.t1134) 4
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Florian Roth (Nextron Systems), David ANDRE (additional keywords)
· 2021-12-20 (modified 2025-10-19) · logsource: product=windows category=process_creation · 2617e7ed-adb7-40ba-b0f3-8f9945fe6c09
Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)
Author: Stamatis Chatzimangou (st0pp3r)
· 2024-01-05 · logsource: product=windows service=security · 7b14c76a-c602-4ae6-9717-eff868153fc0
Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-07-23 · logsource: product=windows category=process_creation · d2b7a134-9c3e-4f8a-b56d-e0c1f8a29b47
Detects suspicious spawning of a process under a different user context than the parent process.
Processes such as notepad.exe, calculator etc. are generally spawned under the same user context and
also they are often targeted as sacrificial process or decoy process to check successful privilege escalation.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-07-23 · logsource: product=windows service=security · e3c6d245-7b8f-4e2a-c17f-a9d0e5b38f62
Detects potentially suspicious explicit credential logon events where the user
is trying to logon with explicit credentials (username and password) that are
different from the current user context. It might indicate an attacker attempting
to escalate privileges after obtaining credentials for a different user account.