Procedure examples

Stuxnet attempts to impersonate an anonymous token to enumerate bindings in the service control manager.

Havoc has a module capable of token impersonation.

Aria-body has the ability to duplicate a token from ntprint.exe.

Emotet has the ability to duplicate the user’s token. For example, Emotet may use a variant of Google’s ProtoBuf to send messages that specify how code will be executed.

BADHATCH can impersonate a `lsass.exe` or `vmtoolsd.exe` token.

Okrum can impersonate a logged-on user's security context using a call to the ImpersonateLoggedOnUser API.

Siloscape impersonates the main thread of CExecSvc.exe by calling NtImpersonateThread.

Fooder has used the `DuplicateTokenEx` API to duplicate the token of a specified process, and `CreateProcessAsUserA` to execute its payload.

LP-Notes has impersonated the security context of the taskhostw.exe process via the `ImpersonateLoggedOnUser` API.

Shamoon can impersonate tokens using LogonUser, ImpersonateLoggedOnUser, and ImpersonateNamedPipeClient.

Tarrask leverages token theft to obtain `lsass.exe` security permissions.

FinFisher uses token manipulation with NtFilterToken as part of UAC bypass.

Cobalt Strike can steal access tokens from exiting processes.

REvil can obtain the token from the user that launched the explorer.exe process to avoid affecting the desktop of the SYSTEM user.

BitPaymer can use the tokens of users to create processes on infected systems.

SILENTTRINITY can find a process owned by a specific user and impersonate the associated token.

Pupy can obtain a list of SIDs and provide the option for selecting process tokens to impersonate.