Access Token Manipulation
Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new toke...
BY SOURCE
PROCEDURES (24)
Auto-extracted: 3 detections for bypass
Auto-extracted: 2 detections for suspicious
Auto-extracted: 2 detections for general monitoring
Auto-extracted: 2 detections for credential
Auto-extracted: 2 detections for service
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for named pipe
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for parent process
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for script execution monitoring
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for masquerad
Auto-extracted: 1 detections for named pipe
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for network connection monitoring
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for parent process