T1134 — Access Token Manipulation

# T1134 - Access Token Manipulation

## SOC Recommendation
Investigate Access Token Manipulation activity in the context of Stealth/Privilege Escalation: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Application Exception Monitoring | Detect | Monitor for Application Exception Monitoring indicators relevant to this technique. |
| Credential Hardening | Harden | Apply Credential Hardening to reduce this technique's viability before an incident occurs. |
| Session Termination | Evict | Use Session Termination to remove the adversary's foothold once this technique is confirmed. |
| System Call Filtering | Isolate | Apply System Call Filtering to contain the blast radius once this technique is observed. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Isolate device | Medium | No | Yes |
| Reset the password of the impersonated account | Medium | No | Yes |
| Check what was accessed with the elevated token | Low | Yes | No |

## KQL
```kql
let SuspiciousInitiators = dynamic([
    "cmd.exe",
    "powershell.exe",
    "pwsh.exe",
    "wscript.exe",
    "cscript.exe",
    "mshta.exe",
    "rundll32.exe",
    "regsvr32.exe"
]);
DeviceLogonEvents
| where Timestamp >= ago(1h)
| where LogonType == "NewCredentials"
| where InitiatingProcessFileName in~ (SuspiciousInitiators)
| project
    Timestamp,
    DeviceName,
    AccountName,
    LogonType,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine,
    RemoteIP
| extend timestamp = Timestamp,
         HostCustomEntity = DeviceName,
         AccountCustomEntity = AccountName
| order by Timestamp desc
```
```kql
AWSSecurityHubFindings
| where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"
| where tostring(AwsSecurityFindingGeneratorId) == "security-control/IAM.4"
  or tostring(ComplianceSecurityControlId) == "IAM.4"
| extend RootUserARN = tostring(Resources[0].Id)
| summarize TimeGenerated = max(TimeGenerated) by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription, AwsSecurityFindingId, ComplianceSecurityControlId, RootUserARN
```
```kql
Pathlock_TDnR_CL
| where DataSource == "PATHLOCK_DAC"
| project TimeGenerated, Sysid, DataSource, Eventid, Instance, Hostname, Bname,
          Tcode, Report, Area, Subid, SrcIp, DestIp, AffectedUser, LogLine,
          MsgType, MsgId, MsgNo, MessageV1, MessageV2, MessageV3, MessageV4, CentralTs
```

## Escalation Criteria
- Access Token Manipulation activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1134.json
• /api/recommendations/T1134.json
• /api/d3fend/T1134.json
• /api/mappings/T1134.json
• /api/confluence/T1134.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1134.json

Response:

{
  "technique_id": "T1134",
  "name": "Access Token Manipulation",
  "priority": "high",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Stealth",
    "Privilege Escalation"
  ],
  "platforms": [
    "Windows"
  ],
  "summary": "Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process...",
  "soc_recommendation": "Investigate Access Token Manipulation activity in the context of Stealth/Privilege Escalation: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-AEM",
      "name": "Application Exception Monitoring",
      "relationship": "detect",
      "practical_action": "Monitor for Application Exception Monitoring indicators relevant to this technique.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-CH",
      "name": "Credential Hardening",
      "relationship": "harden",
      "practical_action": "Apply Credential Hardening to reduce this technique's viability before an incident occurs.",
      "tooling": [
        "Entra ID"
      ]
    },
    {
      "id": "D3-ST",
      "name": "Session Termination",
      "relationship": "evict",
      "practical_action": "Use Session Termination to remove the adversary's foothold once this technique is confirmed.",
      "tooling": [
        "Sentinel",
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-SCF",
      "name": "System Call Filtering",
      "relationship": "isolate",
      "practical_action": "Apply System Call Filtering to contain the blast radius once this technique is observed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed access token manipulation activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"Access Token Manipulation\" -- Detects suspicious use of NewCredentials logons that commonly accompany token manipulation."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Isolate device",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Reset the password of the impersonated account",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Check what was accessed with the elevated token",
      "category": "Response",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "See investigation guide"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "GEN-PE-004 — Access Token Manipulation",
        "description": "Detects suspicious use of NewCredentials logons that commonly accompany token manipulation. (Source: Bell Integration baseline detection library.)",
        "query": "let SuspiciousInitiators = dynamic([\n    \"cmd.exe\",\n    \"powershell.exe\",\n    \"pwsh.exe\",\n    \"wscript.exe\",\n    \"cscript.exe\",\n    \"mshta.exe\",\n    \"rundll32.exe\",\n    \"regsvr32.exe\"\n]);\nDeviceLogonEvents\n| where Timestamp >= ago(1h)\n| where LogonType == \"NewCredentials\"\n| where InitiatingProcessFileName in~ (SuspiciousInitiators)\n| project\n    Timestamp,\n    DeviceName,\n    AccountName,\n    LogonType,\n    InitiatingProcessFileName,\n    InitiatingProcessCommandLine,\n    RemoteIP\n| extend timestamp = Timestamp,\n         HostCustomEntity = DeviceName,\n         AccountCustomEntity = AccountName\n| order by Timestamp desc"
      },
      {
        "name": "171cbece-be87-4467-8754-63d82b3d3dfb — AWS Security Hub - Detect IAM root user Access Key existence",
        "description": "This query detects AWS Security Hub control IAM.4 findings indicating that an AWS account root user Access Key exists. A root user Access Key presents a high risk of privilege abuse and should be removed. (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed), mapped via sub-technique T1134.003.)",
        "query": "AWSSecurityHubFindings\n| where RecordState == \"ACTIVE\" and ComplianceStatus == \"FAILED\"\n| where tostring(AwsSecurityFindingGeneratorId) == \"security-control/IAM.4\"\n  or tostring(ComplianceSecurityControlId) == \"IAM.4\"\n| extend RootUserARN = tostring(Resources[0].Id)\n| summarize TimeGenerated = max(TimeGenerated) by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription, AwsSecurityFindingId, ComplianceSecurityControlId, RootUserARN"
      },
      {
        "name": "2a3b4c5d-6e7f-4a0b-8c1d-2e3f4a5b6c40 — Pathlock TDnR - Dynamic Access Control Events",
        "description": "Detects events from Pathlock Dynamic Access Control (DAC) for SAP, forwarded to Microsoft Sentinel. DAC events capture real-time access policy decisions and violations, including blocked transactions, emergency access grants, and policy bypass attempts that require immediate investigation. (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "Pathlock_TDnR_CL\n| where DataSource == \"PATHLOCK_DAC\"\n| project TimeGenerated, Sysid, DataSource, Eventid, Instance, Hostname, Bname,\n          Tcode, Report, Area, Subid, SrcIp, DestIp, AffectedUser, LogLine,\n          MsgType, MsgId, MsgNo, MessageV1, MessageV2, MessageV3, MessageV4, CentralTs"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "c88d4bd0-5649-4c52-87ea-9be59dbfbcf2 — Parent Process PID Spoofing",
        "description": "(EQL) Identifies parent process spoofing used to thwart detection. Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "/* This rule is compatible with Elastic Endpoint only */\n\nsequence by host.id, user.id with maxspan=3m\n\n [process where host.os.type == \"windows\" and event.type == \"start\" and\n  process.Ext.token.integrity_level_name != \"system\" and\n  (\n    process.pe.original_file_name : (\"winword.exe\", \"excel.exe\", \"outlook.exe\", \"powerpnt.exe\", \"eqnedt32.exe\",\n                                     \"fltldr.exe\", \"mspub.exe\", \"msaccess.exe\", \"powershell.exe\", \"pwsh.exe\",\n                                     \"cscript.exe\", \"wscript.exe\", \"rundll32.exe\", \"regsvr32.exe\", \"msbuild.exe\",\n                                     \"mshta.exe\", \"wmic.exe\", \"cmstp.exe\", \"msxsl.exe\") or\n\n    (process.executable : (\"?:\\\\Users\\\\*.exe\",\n                           \"?:\\\\ProgramData\\\\*.exe\",\n                           \"?:\\\\Windows\\\\Temp\\\\*.exe\",\n                           \"?:\\\\Windows\\\\Tasks\\\\*\") and\n      (process.code_signature.exists == false or process.code_signature.status : \"errorBadDigest\")) or\n\n    process.executable : \"?:\\\\Windows\\\\Microsoft.NET\\\\*.exe\"\n  ) and\n\n  not process.executable :\n             (\"?:\\\\Windows\\\\System32\\\\WerFaultSecure.exe\",\n              \"?:\\\\WINDOWS\\\\SysWOW64\\\\WerFaultSecure.exe\",\n              \"?:\\\\Windows\\\\System32\\\\WerFault.exe\",\n              \"?:\\\\Windows\\\\SysWOW64\\\\WerFault.exe\")\n  ] by process.pid\n [process where host.os.type == \"windows\" and event.type == \"start\" and\n  process.parent.Ext.real.pid > 0 and\n\n  /* process.parent.Ext.real.pid is only populated if the parent process pid doesn't match */\n  not (process.name : \"msedge.exe\" and process.parent.name : \"sihost.exe\") and\n\n   not process.executable :\n             (\"?:\\\\Windows\\\\System32\\\\WerFaultSecure.exe\",\n              \"?:\\\\WINDOWS\\\\SysWOW64\\\\WerFaultSecure.exe\",\n              \"?:\\\\Windows\\\\System32\\\\WerFault.exe\",\n              \"?:\\\\Windows\\\\SysWOW64\\\\WerFault.exe\")\n ] by process.parent.Ext.real.pid"
      },
      {
        "name": "61766ef9-48a5-4247-ad74-3349de7eb2ad — Interactive Logon by an Unusual Process",
        "description": "(EQL) Identifies interactive logon attempt with alternate credentials and by an unusual process. Adversaries may create a new token to escalate privileges and bypass access controls. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "authentication where\n host.os.type : \"windows\" and winlog.event_data.LogonProcessName : \"Advapi*\" and\n winlog.logon.type == \"Interactive\" and winlog.event_data.SubjectUserSid : (\"S-1-5-21*\", \"S-1-12-*\") and\n winlog.event_data.TargetUserSid : (\"S-1-5-21*\", \"S-1-12-*\")  and process.executable : \"C:\\\\*\" and\n not startswith~(winlog.event_data.SubjectUserSid, winlog.event_data.TargetUserSid) and\n not process.executable :\n            (\"?:\\\\Windows\\\\System32\\\\winlogon.exe\",\n             \"?:\\\\Windows\\\\System32\\\\wininit.exe\",\n             \"?:\\\\Program Files\\\\*.exe\",\n             \"?:\\\\Program Files (x86)\\\\*.exe\",\n             \"?:\\\\Windows\\\\SysWOW64\\\\inetsrv\\\\w3wp.exe\",\n             \"?:\\\\Windows\\\\System32\\\\inetsrv\\\\w3wp.exe\",\n             \"?:\\\\Windows\\\\SysWOW64\\\\msiexec.exe\")"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Access Token Manipulation activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1134 - Access Token Manipulation Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}