Access Token Manipulation: Token Impersonation/Theft
Other sub-techniques of Access Token Manipulation (5)
| ID | Name |
|---|---|
| T1134.001 | Token Impersonation/Theft |
| T1134.002 | Create Process with Token |
| T1134.003 | Make and Impersonate Token |
| T1134.004 | Parent PID Spoofing |
| T1134.005 | SID-History Injection |
Adversaries may duplicate then impersonate another user's token to escalate privileges and bypass access controls. An adversary can create a new access token that duplicates an existing token using DuplicateToken(Ex). The token can then be used with ImpersonateLoggedOnUser to allow the calling thread to impersonate a logged on user's security context, or with SetThreadToken to assign the impersonated token to a thread.
An adversary may do this when they have a specific, existing process they want to assign the new token to. For example, this may be useful for when the target user has a non-network logon session on the system.
Procedure Examples
| Name | Description |
|---|---|
| APT28 |
APT28 has used CVE-2015-1701 to access the SYSTEM token and copy it into the current process as part of privilege escalation.[11] |
| Aria-body |
Aria-body has the ability to duplicate a token from ntprint.exe.[9] |
| Cobalt Strike |
Cobalt Strike can steal access tokens from exiting processes.[5] |
| FinFisher |
FinFisher uses token manipulation with NtFilterToken as part of UAC bypass.[6][7] |
| Okrum |
Okrum can impersonate a logged-on user's security context using a call to the ImpersonateLoggedOnUser API.[8] |
| Pupy |
Pupy can obtain a list of SIDs and provide the option for selecting process tokens to impersonate.[4] |
| Shamoon |
Shamoon can impersonate tokens using |
Mitigations
| Mitigation | Description |
|---|---|
| Privileged Account Management |
Limit permissions so that users and user groups cannot create tokens. This setting should be defined for the local system account only. GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Create a token object. [1] Also define who can create a process level token to only the local and network service through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Replace a process level token.[2] Administrators should log in as a standard user but run their tools with administrator privileges using the built-in access token manipulation command |
| User Account Management |
An adversary must already have administrator level access on the local system to make full use of this technique; be sure to restrict users and accounts to the least privileges they require. |
Detection
If an adversary is using a standard command-line shell, analysts can detect token manipulation by auditing command-line activity. Specifically, analysts should look for use of the runas command. Detailed command-line logging is not enabled by default in Windows.[12]
Analysts can also monitor for use of Windows APIs such as DuplicateToken(Ex), ImpersonateLoggedOnUser , and SetThreadToken and correlate activity with other suspicious behavior to reduce false positives that may be due to normal benign use by users and administrators.
References
- Brower, N., Lich, B. (2017, April 19). Create a token object. Retrieved December 19, 2017.
- Brower, N., Lich, B. (2017, April 19). Replace a process level token. Retrieved December 19, 2017.
- Microsoft TechNet. (n.d.). Runas. Retrieved April 21, 2017.
- Nicolas Verdier. (n.d.). Retrieved January 29, 2018.
- Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017.
- FinFisher. (n.d.). Retrieved December 20, 2017.
- Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.
- Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.
- CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.
- Mundo, A., Roccia, T., Saavedra-Morales, J., Beek, C.. (2018, December 14). Shamoon Returns to Wipe Systems in Middle East, Europe . Retrieved May 29, 2020.
- FireEye Labs. (2015, April 18). Operation RussianDoll: Adobe & Windows Zero-Day Exploits Likely Leveraged by Russia’s APT28 in Highly-Targeted Attack. Retrieved April 24, 2017.
- Mathers, B. (2017, March 7). Command line process auditing. Retrieved April 21, 2017.