{
  "type": "course-of-action",
  "spec_version": "2.1",
  "id": "course-of-action--c61fee9f-16fb-4f8c-bbf0-869093fcd4a6",
  "created": "2018-10-17T00:14:20.652Z",
  "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "external_references": [
    {
      "source_name": "mitre-attack",
      "url": "https://attack.mitre.org/mitigations/T1134",
      "external_id": "T1134"
    },
    {
      "source_name": "Microsoft Create Token",
      "description": "Brower, N., Lich, B. (2017, April 19). Create a token object. Retrieved December 19, 2017.",
      "url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/create-a-token-object"
    },
    {
      "source_name": "Microsoft Replace Process Token",
      "description": "Brower, N., Lich, B. (2017, April 19). Replace a process level token. Retrieved December 19, 2017.",
      "url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/replace-a-process-level-token"
    }
  ],
  "object_marking_refs": [
    "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
  ],
  "modified": "2025-04-18T18:00:13.244Z",
  "name": "Access Token Manipulation Mitigation",
  "description": "Access tokens are an integral part of the security system within Windows and cannot be turned off. However, an attacker must already have administrator level access on the local system to make full use of this technique; be sure to restrict users and accounts to the least privileges they require to do their job.\n\nAny user can also spoof access tokens if they have legitimate credentials. Follow mitigation guidelines for preventing adversary use of [Valid Accounts](https://attack.mitre.org/techniques/T1078). Limit permissions so that users and user groups cannot create tokens. This setting should be defined for the local system account only. GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Create a token object. (Citation: Microsoft Create Token) Also define who can create a process level token to only the local and network service through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Replace a process level token. (Citation: Microsoft Replace Process Token)\n\nAlso limit opportunities for adversaries to increase privileges by limiting Privilege Escalation opportunities.",
  "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "x_mitre_deprecated": true,
  "x_mitre_domains": [
    "enterprise-attack"
  ],
  "x_mitre_version": "1.0",
  "x_mitre_attack_spec_version": "3.2.0"
}