Home/ MITRE Matrix/ Defense Evasion/ T1134

T1134Access Token Manipulation

T1134 — Access Token Manipulation is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 6 detection use cases covering it and 1 threat-intel article citing it.

Defense EvasionPrivilege Escalation

View on the matrix → Filter Detection Library MITRE official spec ↗

6Use cases

1Articles

5Sub-techniques

2Tactics

Sub-techniques (5)

T1134.002 · Create Process with Token T1134.003 · Make and Impersonate Token T1134.004 · Parent PID Spoofing T1134.005 · SID-History Injection T1134.001 · Token Impersonation/Theft

Use cases covering this technique (6)

Windows Privilege Escalation Suspicious Process Elevation ESCU actions · alerting P Windows Privilege Escalation System Process Without System Parent ESCU actions · alerting P Windows Privilege Escalation User Process Spawn System Process ESCU actions · alerting P Splunk RBAC Bypass On Indexing Preview REST Endpoint ESCU actions · hunting P [LLM] OpenDJ SASL PLAIN bind invoking proxied authorization (authzid) — impersonation Bespoke exploit · hunting SΣPDD [LLM] OpenDJ proxied-auth fan-out — one source assuming many distinct authz identities Bespoke actions · hunting SPDD

Articles citing this technique (1)

crit [GHSA / CRITICAL] GHSA-p279-2cqp-84jg: OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check art-81