Token Impersonation/Theft
Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`.(Citation: DuplicateToken function) The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread. An adversary may perform [T...
BY SOURCE
PROCEDURES (13)
Auto-extracted: 2 detections for credential
Auto-extracted: 2 detections for remote
Auto-extracted: 2 detections for named pipe
Auto-extracted: 2 detections for api
Auto-extracted: 2 detections for service
Auto-extracted: 2 detections for general monitoring
Auto-extracted: 2 detections for token
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for named pipe
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for api