1. STEALING TOKENS
1.1 SUMMARY
Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. These tokens can then be applied to an existing process (i.e. Token Impersonation/Theft) or used to spawn a new process (i.e. Create Process with Token). An adversary must already be in a privileged user context (i.e. administrator) to steal a token. However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level. An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.
Any standard user can use the runas command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account.
1.2 MITRE
Access Token Theft: Table Summary
| Category | Details |
|---|---|
| Threat | Access token theft for privilege escalation and impersonation of SYSTEM-level accounts |
| MITRE ATT&CK | T1134 – Access Token Manipulation |
| Common APIs Used | OpenProcess(), OpenProcessToken(), ImpersonateLoggedOnUser(), DuplicateTokenEx(), CreateProcessWithTokenW() |
| Typical Target Process | winlogon.exe (commonly abused for SYSTEM token impersonation) |
| Alternative Targets | services.exe, lsass.exe, smss.exe, csrss.exe |
| Why SYSTEM Tokens? | SYSTEM retains powerful privileges (e.g., SeDebugPrivilege) even when restricted for local admins |
| Detection Challenge | Over-reliance on monitoring winlogon.exe can overlook token theft using other SYSTEM processes |
| Defensive Actions | - Audit all SYSTEM processes - Enforce least privilege - Deploy security tooling - Educate users |
Access token theft is a critical attack vector in Windows environments, allowing adversaries to impersonate high-privilege accounts such as NT AUTHORITY\SYSTEM. This tactic is aligned with MITRE ATT&CK technique T1134 (Access Token Manipulation). While winlogon.exe is a common target, focusing only on it can limit detection capabilities.
1.3 PRIMARY VS. IMPERSONATION TOKENS
The primary access token is the main token assigned to a process when it is created, defining the security context under which the process operates. It determines the privileges, group memberships, and security identifiers (SIDs) that the process inherits from the user or session initiating it.
In addition to the primary access token, a process or its threads can use other types of access tokens, most notably impersonation tokens. These tokens allow a process or thread to operate under a different security context than that of the primary access token.
An impersonation token is a temporary token assigned to a thread (or occasionally a process) to perform actions on behalf of another user or security context. Unlike the primary access token, impersonation tokens are typically used by threads rather than the entire process. Impersonation allows a process to act as another user or entity, often in client-server scenarios (e.g., a server process impersonating a client to access resources on their behalf).
1.4 STEALING ACCESS TOKENS
Attackers use several Windows API functions to steal and manipulate access tokens:
OpenProcess()– Opens a handle to a target process.OpenProcessToken()– Retrieves the access token from the process.ImpersonateLoggedOnUser()– Impersonates another user's security context.DuplicateTokenEx()– Duplicates an existing token.CreateProcessWithTokenW()– Launches a new process with a token.
These functions enable privilege escalation and lateral movement.
1.5 ELEVATING TO SYSTEM PRIVILEGES
Even if local admins have restricted privileges (e.g., no SeDebugPrivilege), SYSTEM processes retain them. By impersonating SYSTEM tokens, attackers bypass security restrictions and gain full system control.
1.6 DETECTION CHALLENGES
Most defenses focus on winlogon.exe as the source of SYSTEM tokens. This narrow focus can miss other viable SYSTEM processes that attackers may target. Broadening monitoring scope improves detection efficacy.
1.7 ALTERNATIVE SYSTEM PROCESSES
Other SYSTEM processes that can be targeted include:
services.exe– Manages system services.lsass.exe– Handles authentication.smss.exe– Session manager.csrss.exe– Manages user-mode side of the Win32 subsystem.
Monitoring these increases resilience to token theft.
1.8 DEFENSIVE MEASURES
- Audit SYSTEM Processes – Monitor for token misuse.
- Enforce Least Privilege – Restrict unnecessary privileges.
- Security Tools – Use tools that detect token-related anomalies.
- User Education – Train users against phishing and social engineering.
By understanding access token theft techniques and expanding detection beyond winlogon.exe, defenders can significantly improve Windows environment security.
1.9 GET-TOKEN
The following Windows API calls can be used to steal and abuse access tokens: OpenProcess(), OpenProcessToken(), ImpersonateLoggedOnUser(), DuplicateTokenEx(), CreateProcessWithTokenW().
