Access Token Manipulation: Create Process with Token

Created the Friday 27 January 2023. Updated 1 year, 7 months ago.

Adversaries may create a new process with a different token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as CreateProcessWithTokenW and runas.

Creating processes with a different token may require the credentials of the target user, specific privileges to impersonate that user, or access to the token to be used (ex: gathered via other means such as Token Impersonation/Theft or Make and Impersonate Token).

Technique Identifier

T1134.002

Technique Tags

Defense Evasion Privilege Escalation CreateProcessWithTokenW runas Token Impersonation Token Theft Make Token Impersonate Token

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

Access Token Manipulation: Create Process with Token, Sub-technique T1134.002 - Enterprise | MITRE ATT&CK®