Access Token Manipulation

ATT&CK T1134

Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token. An adversary can use built-in Windows API functions to copy access tokens from existing processes

Category: Technique, stealth, privilege-escalation

MITRE ATT&CK: T1134

Reference: MITRE ATT&CK T1134