Search Evasion Techniques
Names, Techniques, Definitions, Keywords
Search Result
2 item(s) found so far for this keyword.
Access Token Manipulation: Token Impersonation/Theft Defense Evasion [Mitre]
Adversaries may duplicate then impersonate another user's token to escalate privileges and bypass access controls. An adversary can create a new access token that duplicates an existing token using DuplicateToken(Ex). The token can then be used with ImpersonateLoggedOnUser to allow the calling thread to impersonate a logged on user's security context, or with SetThreadToken to assign the impersonated token to …
Access Token Manipulation: Make and Impersonate Token Defense Evasion [Mitre]
Adversaries may make and impersonate tokens to escalate privileges and bypass access controls. If an adversary has a username and password but the user is not logged onto the system, the adversary can then create a logon session for the user using the LogonUser function. The function will return a copy of the new session's access token and the adversary …