Procedure examples

Mafalda can use `AdjustTokenPrivileges()` to elevate privileges.

BlackCat has the ability modify access tokens.

Cuba has used SeDebugPrivilege and AdjustTokenPrivileges to elevate privileges.

Hydraq creates a backdoor through which remote attackers can adjust token privileges.

Sagerunex finds the `explorer.exe` process after execution and uses it to change the token of its executing thread.

MegaCortex can enable SeDebugPrivilege and adjust token privileges.

Ryuk has attempted to adjust its token privileges to have the SeDebugPrivilege.

HermeticWiper can use `AdjustTokenPrivileges` to grant itself privileges for debugging with `SeDebugPrivilege`, creating backups with `SeBackupPrivilege`, loading drivers with `SeLoadDriverPrivilege`, and shutting down a local system with `SeShutdownPrivilege`.

SUNSPOT modified its security token to grants itself debugging privileges by adding SeDebugPrivilege.

KillDisk has attempted to get the access token of a process by calling OpenProcessToken. If KillDisk gets the access token, then it attempt to modify the token privileges with AdjustTokenPrivileges.

Qilin can use an embedded Mimikatz module for token manipulation.

Gelsemium can use token manipulation to bypass UAC on Windows7 systems.

Sliver has the ability to manipulate user tokens on targeted Windows systems.

PowerSploit's Invoke-TokenManipulation Exfiltration module can be used to manipulate tokens.

Empire can use PowerSploit's Invoke-TokenManipulation to manipulate access tokens.

PoshC2 can use Invoke-TokenManipulation for manipulating tokens.

Duqu examines running system processes for tokens that have specific system privileges. If it finds one, it will copy the token and store it for later use. Eventually it will start new processes with the stored token attached. It can also steal tokens to acquire administrative privileges.

During HomeLand Justice, threat actors used custom tooling to acquire tokens using `ImpersonateLoggedOnUser/SetThreadToken`.

APT28 has used CVE-2015-1701 to access the SYSTEM token and copy it into the current process as part of privilege escalation.

FIN8 has used a malicious framework designed to impersonate the lsass.exe/vmtoolsd.exe token.

Stuxnet attempts to impersonate an anonymous token to enumerate bindings in the service control manager.

Havoc has a module capable of token impersonation.

Aria-body has the ability to duplicate a token from ntprint.exe.

Emotet has the ability to duplicate the user’s token. For example, Emotet may use a variant of Google’s ProtoBuf to send messages that specify how code will be executed.

BADHATCH can impersonate a `lsass.exe` or `vmtoolsd.exe` token.

Okrum can impersonate a logged-on user's security context using a call to the ImpersonateLoggedOnUser API.

Siloscape impersonates the main thread of CExecSvc.exe by calling NtImpersonateThread.

Fooder has used the `DuplicateTokenEx` API to duplicate the token of a specified process, and `CreateProcessAsUserA` to execute its payload.

LP-Notes has impersonated the security context of the taskhostw.exe process via the `ImpersonateLoggedOnUser` API.

Shamoon can impersonate tokens using LogonUser, ImpersonateLoggedOnUser, and ImpersonateNamedPipeClient.

Tarrask leverages token theft to obtain `lsass.exe` security permissions.

FinFisher uses token manipulation with NtFilterToken as part of UAC bypass.

Cobalt Strike can steal access tokens from exiting processes.

REvil can obtain the token from the user that launched the explorer.exe process to avoid affecting the desktop of the SYSTEM user.

BitPaymer can use the tokens of users to create processes on infected systems.

SILENTTRINITY can find a process owned by a specific user and impersonate the associated token.

Pupy can obtain a list of SIDs and provide the option for selecting process tokens to impersonate.

Turla RPC backdoors can impersonate or steal process tokens before executing commands.

Lazarus Group keylogger KiloAlfa obtains user tokens from interactive sessions to execute itself with API call CreateProcessAsUserA under that user's context.

Bankshot grabs a user token using WTSQueryUserToken and then creates a process by impersonating a logged-on user.

TONESHELL included functionality to create sub-processes with a specific user’s token.

Aria-body has the ability to execute a process using runas.

The WhisperGate third stage can use the AdvancedRun.exe tool to execute commands in the context of the Windows TrustedInstaller group via `%TEMP%\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run`.

PipeMon can attempt to gain administrative privileges using token impersonation.

KONNI has duplicated the token of a high integrity process to spawn an instance of cmd.exe under an impersonated user.

REvil can launch an instance of itself with administrative rights using runas.

ZxShell has a command called RunAs, which creates a new process as another user or process context.

Azorult can call WTSQueryUserToken and CreateProcessAsUser to start a new process with local system privileges.

Empire can use Invoke-RunAs to make tokens.

PoshC2 can use Invoke-RunAs to make tokens.