MITRE ATT&CK technique
Access Token Manipulation detection rulesT1134
Access Token Manipulation (T1134) is a MITRE ATT&CK technique in the Privilege Escalation tactic. This page lists the 18 community-maintained Sigma detection rules in the library mapped to T1134 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows.
Top products
Tactic
HackTool - Koh Default Named Pipe
criticalDetects creation of default named pipes used by the Koh tool
windows · pipe_created
HackTool - NoFilter Execution
highDetects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators
windows
HackTool - PPID Spoofing SelectMyParent Tool Execution
highDetects the use of parent process ID spoofing tools like Didier Stevens tool SelectMyParent
windows · process_creation
HackTool - SharpDPAPI Execution
highDetects the execution of the SharpDPAPI tool based on CommandLine flags and PE metadata. SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.
windows · process_creation
HackTool - SharpImpersonation Execution
highDetects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively
windows · process_creation
Meterpreter or Cobalt Strike Getsystem Service Installation - Security
highDetects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation
windows
Meterpreter or Cobalt Strike Getsystem Service Installation - System
highDetects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation
windows
Potential Meterpreter/CobaltStrike Activity
highDetects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting
windows · process_creation
PUA - AdvancedRun Suspicious Execution
highDetects the execution of AdvancedRun utility in the context of the TrustedInstaller, SYSTEM, Local Service or Network Service accounts
windows · process_creation
RedSun - Conhost.exe Spawned by TieringEngineService.exe
highDetects two stages of the RedSun post-exploitation process chain that deliver a SYSTEM-level shell to the attacker's interactive session. Observed process chain services.exe → TieringEngineService.exe → conhost.exe (SYSTEM, CommandLine: bare path, no arguments) → cmd.exe / shell (SYSTEM, TerminalSessionId = attacker's session) Stage 1 — TieringEngineService.exe spawns argument-less conhost.exe: After winning the oplock + Cloud Files mount point race, the malicious TieringEngineService.exe (RedSun.exe copied to System32, started via CoCreateInstance / services.exe) detects it is NT AUTHORITY\SYSTEM and calls LaunchConsoleInSessionId(). This opens \\.\pipe\REDSUN, reads the attacker's session ID, duplicates the SYSTEM token, re-stamps it with that session ID via SetTokenInformation(TokenSessionId), then calls CreateProcessAsUser to spawn conhost.exe with no arguments. Stage 2 — Shell spawned from rogue conhost.exe (EDR sources with GrandParentImage): The rogue SYSTEM conhost.exe spawns a shell (cmd.exe, PowerShell, etc.) as SYSTEM in the attacker's interactive session. On EDR sources that expose GrandParentImage, the full three-level chain (TieringEngineService.exe → conhost.exe → shell) can be matched directly. The legitimate TieringEngineService.exe is a headless COM server that is unlikely to spawn conhost.exe under normal conditions.
windows · process_creation
Suspicious Child Process Created as System
highDetection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts
windows · process_creation
Suspicious SYSTEM User Process Creation
highDetects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)
windows · process_creation
Addition of SID History to Active Directory Object
mediumAn attacker can use the SID history attribute to gain additional privileges.
windows
HackTool - Impersonate Execution
mediumDetects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively
windows · process_creation
Potential Access Token Abuse
mediumDetects potential token impersonation and theft. Example, when using "DuplicateToken(Ex)" and "ImpersonateLoggedOnUser" with the "LOGON32_LOGON_NEW_CREDENTIALS flag".
windows
Potentially Suspicious Explicit Credential Local Logon
mediumDetects potentially suspicious explicit credential logon events where the user is trying to logon with explicit credentials (username and password) that are different from the current user context. It might indicate an attacker attempting to escalate privileges after obtaining credentials for a different user account.
windows
PUA - AdvancedRun Execution
mediumDetects the execution of AdvancedRun utility
windows · process_creation
Suspicious Cross-User Process Spawn
mediumDetects suspicious spawning of a process under a different user context than the parent process. Processes such as notepad.exe, calculator etc. are generally spawned under the same user context and also they are often targeted as sacrificial process or decoy process to check successful privilege escalation.
windows · process_creation