// MITRE ATT&CK
T1134 · Access Token Manipulation
🎯 Stealth Windows
Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though ...
¿Cómo detectarlo y mitigarlo?
La detección de Access Token Manipulation parte de la telemetría de tu SIEM/EDR. Escribe una regla de detección con el generador Sigma, analiza logs sospechosos en el analizador de logs y sitúa la técnica en tu cobertura con la matriz ATT&CK.
Sub-técnicas (5)
T1134.001
Token Impersonation/Theft T1134.002
Create Process with Token T1134.003
Make and Impersonate Token T1134.004
Parent PID Spoofing T1134.005
SID-History Injection
Token Impersonation/Theft T1134.002
Create Process with Token T1134.003
Make and Impersonate Token T1134.004
Parent PID Spoofing T1134.005
SID-History Injection
Técnicas relacionadas
T1055.011
Extra Window Memory Injection T1205.002
Socket Filters T1027.011
Fileless Storage T1218.011
Rundll32 T1027.009
Embedded Payloads T1564.012
File/Path Exclusions T1216.001
PubPrn T1574.007
Path Interception by PATH Environment Variable
Extra Window Memory Injection T1205.002
Socket Filters T1027.011
Fileless Storage T1218.011
Rundll32 T1027.009
Embedded Payloads T1564.012
File/Path Exclusions T1216.001
PubPrn T1574.007
Path Interception by PATH Environment Variable
Fuente: MITRE ATT&CK®. ATT&CK es una marca registrada de The MITRE Corporation. Contenido con fines educativos.