{
  "technique_id": "T1134",
  "name": "Access Token Manipulation",
  "tactics": [
    "Stealth",
    "Privilege Escalation"
  ],
  "platforms": [
    "Windows"
  ],
  "summary": "Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process...",
  "generated_by": "SOC Response Atlas by Basyrix"
}