T1134.001 — Token Impersonation/Theft

Tactics: Stealth, Privilege Escalation · Platforms: Windows

Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`. The token can then be used with `ImpersonateLoggedOnUser` to allow the…

Sub-technique of Access Token Manipulation (T1134).

Sigma detection rules (1)

T1134.001 Access Token Manipulation: Token Impersonation/Theft

title: "T1134.001 Access Token Manipulation: Token Impersonation/Theft"
id: c12f7ce2-2ae5-4d8e-b07c-b4d8fd663076
description: 'Behavior-chain detection for T1134.001 Access Token Manipulation: Token Impersonation/Theft on Windows. (Retargeted from the original process_creation label to process_access — this is the telemetry source that actually captures this technique''s behavior; see logsource below.) Tune using: AllowedSystemProcesses, TimeWindow, UserContextFilter, ParentProcessAnomalyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1134/001
author: Shahrukh Khan
date: 2026-01-13
license: MIT
tags:
  - attack.stealth
  - attack.privilege-escalation
  - attack.t1134.001

logsource:
  category: process_access
  product: windows
  service: sysmon

detection:
  selection:
    GrantedAccess:
      - '0x1F0FFF'
      - '0x1FFFFF'
    TargetImage|endswith: '\lsass.exe'

  filter_avedr:
    SourceImage|endswith:
      - '\MsMpEng.exe'
      - '\CSFalconService.exe'

  condition: selection and not filter_avedr

falsepositives:
  - Legitimate AV/EDR agents accessing lsass.exe for scanning; verify SourceImage against your security stack before treating as benign.

level: critical

Related sub-techniques

Explore