T1134.002, Create Process with Token, is an Access Token Manipulation sub-technique. The adversary starts a new process using another user's existing token and gets that user's security context. MITRE files it under stealth and privilege escalation, for Windows.
How attackers use it
The features involved are CreateProcessWithTokenW and the runas command. MITRE points out that using a token that does not belong to the current user may require the target user's credentials, specific privileges to impersonate that user, or access to the token itself.
That is why it usually comes second. The token may first be duplicated through Token Impersonation/Theft (T1134.001) or created through Make and Impersonate Token (T1134.003). The page lists tools and malware that use it, such as Empire, PoshC2 and REvil.
How to detect it
MITRE's chain: a process, often after stealing or creating a token, calls CreateProcessWithTokenW or CreateProcessAsUserW, or uses runas, to start a new process whose security context differs from its parent. That context includes the SID, the logon ID and the integrity level.
The full sequence is a suspicious command or API call, then a privileged handle or token duplication, then a child running as another user or at higher integrity, then optional privileged or lateral actions.
What you can see without deep API telemetry is the child and parent comparison. In process creation logs (Security 4688, Sysmon event ID 1), look for a child whose user or integrity differs from its parent in ways your admins would not do by hand.
How to reduce the risk
- Limit who can create tokens. Define the Create a token object right for the local system account only, and limit who can create a process level token to the local and network service accounts.
- Restrict accounts to least privilege. The adversary needs administrator access to use this fully, so fewer admins means a smaller risk.
Quick check
Which two features does MITRE name for this technique?
CreateProcessWithTokenW and the runas command.
Sources
- MITRE ATT&CK, T1134.002 Create Process with Token
