Token Manipulation / Privilege Escalation Response
When token theft (T1134.001), process creation with token (T1134.002), token creation and impersonation (T1134.003), or SID-History injection (T1134.005) is suspected, performs API chain verification, containment, and privilege model hardening steps.
OpenProcessToken → DuplicateTokenEx → CreateProcessAsUser API chain should be monitored by EDR; in SID History attacks, unexpected SID values should be sought during Kerberos ticket analysis. Removing SeDebugPrivilege from service accounts narrows the token theft vector. In environments where the distinction between domain admin and local admin is clearly enforced, the blast radius of this technique is significantly reduced.Prepare
4 steps- Sysmon and security log telemetry validation
Periodically verify that EID 10 (ProcessAccess) `TOKEN_DUPLICATE` access mask, Security 4624 LogonType 9, and Security 4688 `SubjectLogonId` ≠ `TargetLogonId` correlation are being forwarded to SIEM.
- Legitimate tool allowlist
EDR, AV, debugger, and backup agents perform legitimate token access to SYSTEM processes; keep these tools on the allowlist to reduce false positive noise.
- Integrity level triage guidance
Medium → High escalation: redirect to UAC bypass playbook; High → SYSTEM token theft (T1134.001); Medium → SYSTEM via service account, consider Potato variants (PB-C); LogonType 9 from unexpected process: T1134.003.
- Escalation chain
If command activity is detected in SYSTEM context, IR Lead and AD administrator must be engaged simultaneously; lateral movement potential broadens domain scope.
Detect & Analyze
6 steps- Identify source process and target