Access Token Manipulation T1134
Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as…
- Tactics
- Stealth, Privilege Escalation
- Actors using it
- 9
- Sub-techniques
- 0
Ransomware groups reported using it
Threat actors
- APT28Russia · IRON TWILIGHT, SNAKEMACKEREL, Swallowtail · 73 techniques
- Lazarus GroupNorth Korea · Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace · 69 techniques
- TurlaRussia · IRON HUNTER, Group 88, Waterbug · 50 techniques
- BlackByteHecamede · 44 techniques
- FIN13Elephant Beetle · 42 techniques
- FIN6Magecart Group 6, ITG08, Skeleton Spider · 33 techniques
- FIN8Syssphinx · 31 techniques
- Blue Mockingbird19 techniques
- Lotus BlossomDRAGONFISH, Spring Dragon, RADIUM · 17 techniques