T1134.003, Make and Impersonate Token, is an Access Token Manipulation sub-technique for Windows, filed under stealth and privilege escalation. Instead of copying a token that already exists, the adversary makes a new one.
How attackers use it
MITRE's example: an adversary has a username and password, but the user is not logged on to the system. The adversary can create a logon session for that user with the LogonUser function. It returns a copy of the new session's access token, and SetThreadToken assigns that token to a thread.
That is the difference from Token Impersonation/Theft (T1134.001). There, a token is duplicated. Here, a new one is created, which means the adversary already holds valid credentials. The page lists BlackByte, Cobalt Strike and SILENTTRINITY among tools and malware that use it.
How to detect it
MITRE's chain for Windows has five links:
- A suspicious command or script block, for example
runas /netonly, or PowerShell callingLogonUser. - ETW or API evidence of
LogonUserandSetThreadToken. - Security event 4624 (new logon), often logon type 9 (NewCredentials), or type 2 or 3 from a non-interactive parent, with no interactive desktop.
- Sysmon event ID 1 showing processes that run with the new logon ID or SID, different from the parent.
- Optional privileged operations or lateral movement.
The most accessible piece is the logon event. A type 9 logon is not malicious in itself, since runas /netonly is a legitimate admin habit, so baseline who uses it and where.
How to reduce the risk
- Least privilege accounts. Restrict users and accounts to what they need, since the adversary needs administrator access on the system for full use.
- Limit token creation rights. Define Create a token object for the local system account only.
- Protect the credentials. The technique starts with a known password, so every control that stops password theft reduces it.
Quick check
Which logon type does MITRE call out for this technique?
Logon type 9, NewCredentials, in Security event 4624.
Sources
- MITRE ATT&CK, T1134.003 Make and Impersonate Token
