Procedure examples

AppleSeed can gain system level privilege by passing SeDebugPrivilege to the AdjustTokenPrivilege API.

SslMM contains a feature to manipulate process privileges and tokens.

Mafalda can use `AdjustTokenPrivileges()` to elevate privileges.

BlackCat has the ability modify access tokens.

Cuba has used SeDebugPrivilege and AdjustTokenPrivileges to elevate privileges.

Hydraq creates a backdoor through which remote attackers can adjust token privileges.

Sagerunex finds the `explorer.exe` process after execution and uses it to change the token of its executing thread.

MegaCortex can enable SeDebugPrivilege and adjust token privileges.

Ryuk has attempted to adjust its token privileges to have the SeDebugPrivilege.

HermeticWiper can use `AdjustTokenPrivileges` to grant itself privileges for debugging with `SeDebugPrivilege`, creating backups with `SeBackupPrivilege`, loading drivers with `SeLoadDriverPrivilege`, and shutting down a local system with `SeShutdownPrivilege`.

SUNSPOT modified its security token to grants itself debugging privileges by adding SeDebugPrivilege.

KillDisk has attempted to get the access token of a process by calling OpenProcessToken. If KillDisk gets the access token, then it attempt to modify the token privileges with AdjustTokenPrivileges.

Qilin can use an embedded Mimikatz module for token manipulation.

Gelsemium can use token manipulation to bypass UAC on Windows7 systems.

Sliver has the ability to manipulate user tokens on targeted Windows systems.

PowerSploit's Invoke-TokenManipulation Exfiltration module can be used to manipulate tokens.

Empire can use PowerSploit's Invoke-TokenManipulation to manipulate access tokens.

PoshC2 can use Invoke-TokenManipulation for manipulating tokens.

Duqu examines running system processes for tokens that have specific system privileges. If it finds one, it will copy the token and store it for later use. Eventually it will start new processes with the stored token attached. It can also steal tokens to acquire administrative privileges.