T1134.003 — Make and Impersonate Token

Tactics: Stealth, Privilege Escalation · Platforms: Windows

Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function.…

Sub-technique of Access Token Manipulation (T1134).

Sigma detection rules (1)

T1134.003 Access Token Manipulation: Make and Impersonate Token

title: "T1134.003 Access Token Manipulation: Make and Impersonate Token"
id: d21c3e06-bc19-44af-baba-9beff8ac5417
description: 'Detects logon events using LogonType 9 (NewCredentials), the Windows-observable artifact left when a process calls LogonUser to create a new logon session/token and impersonates it, consistent with Make and Impersonate Token abuse. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, SuspiciousLogonTypes, AllowedImpersonators, ParentChildUserMismatch.'
references:
  - https://attack.mitre.org/techniques/T1134/003
author: Shahrukh Khan
date: 2026-01-19
license: MIT
tags:
  - attack.stealth
  - attack.privilege-escalation
  - attack.t1134.003

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID: '4624'
    LogonType: '9'

  filter_system_account:
    TargetUserName|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate administrative use of runas /netonly and some deployment/scheduling tooling also produce LogonType 9 events; System and service accounts are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

Related sub-techniques

Explore