Home/ MITRE Matrix/ Defense Evasion/ T1134

T1134Access Token Manipulation

T1134 — Access Token Manipulation is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 3 detection use cases covering it.

Defense EvasionPrivilege Escalation

View on the matrix → Filter Detection Library MITRE official spec ↗

3Use cases

0Articles

5Sub-techniques

2Tactics

Sub-techniques (5)

T1134.002 · Create Process with Token T1134.003 · Make and Impersonate Token T1134.004 · Parent PID Spoofing T1134.005 · SID-History Injection T1134.001 · Token Impersonation/Theft

Use cases covering this technique (3)

Windows Privilege Escalation Suspicious Process Elevation ESCU actions · alerting P Windows Privilege Escalation System Process Without System Parent ESCU actions · alerting P Windows Privilege Escalation User Process Spawn System Process ESCU actions · alerting P