T1134.002 — Create Process with Token

Tactics: Stealth, Privilege Escalation · Platforms: Windows

Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as CreateProcessWithTokenW and runas. Creating processes with a token not…

Sub-technique of Access Token Manipulation (T1134).

Sigma detection rules (1)

T1134.002 Access Token Manipulation: Create Process with Token

title: "T1134.002 Access Token Manipulation: Create Process with Token"
id: efe2e434-4c8e-458f-bd5e-2f3050bbab0c
description: 'Detects use of runas.exe with an explicit /user: target. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, AllowedImpersonators, IntegrityEscalationDelta, ParentChildUserMismatch, SensitiveTargets.'
references:
  - https://attack.mitre.org/techniques/T1134/002
author: Shahrukh Khan
date: 2026-05-02
license: MIT
tags:
  - attack.stealth
  - attack.privilege-escalation
  - attack.t1134.002

logsource:
  category: process_creation
  product: windows

detection:
  selection:
    Image|endswith: '\runas.exe'
    CommandLine|contains: '/user:'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not filter_system_account

falsepositives:
  - Legitimate administrative use of runas.exe.

level: medium

Related sub-techniques

Explore