T1134.001: Token Impersonation/Theft
Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`.[1] The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread.
An adversary may perform Token Impersonation/Theft when they have a specific, existing process they want to assign the duplicated token to. For example, this may be useful for when the target user has a non-network logon session on the system.
When an adversary would instead use a duplicated token to create a new process rather than attaching to an existing process, they can additionally Create Process with Token using `CreateProcessWithTokenW` or `CreateProcessAsUserW`. Token Impersonation/Theft is also distinct from Make and Impersonate Token in that it refers to duplicating an existing token, rather than creating a new one.
Analyst context for executives and security teams
Token Impersonation/Theft is a Windows privilege-escalation and stealth behavior where an adversary duplicates an existing user token and applies that security context to a thread or existing process. For leaders, the practical issue is trust: if a compromised process can act as a higher-privileged or different logged-on user, access controls and audit assumptions may no longer reflect who truly performed an action.
Executive priority
Prioritize this behavior where Windows administrative access, privileged sessions, or sensitive operational systems are in scope. ATT&CK maps this sub-technique to Access Token Manipulation and to multiple groups, campaigns, and software families, including ransomware, wiper, post-exploitation, and ICS-relevant malware. The decision value is validating whether account governance, privileged account management, endpoint telemetry, and incident response procedures can distinguish legitimate delegated activity from suspicious token reuse.
Technical view
This is a Windows sub-technique under stealth and privilege escalation. The supplied ATT&CK description specifically references duplicated existing tokens and Windows APIs such as DuplicateToken, DuplicateTokenEx, ImpersonateLoggedOnUser, and SetThreadToken. SOC and IR teams should validate whether they can correlate suspicious process or thread security-context changes with the source process, target user context, logon session type, and privilege level. Because ATT&CK provides no official detection text for this object, detection engineering should be behavior-chain oriented and should use the related DET0482 strategy as the relationship-supported direction rather than relying on a single event.
Likely telemetry
- Windows endpoint process and thread activity showing security-context or token-related behavior
- API-level or EDR telemetry for token duplication and impersonation-related calls where available
- Process lineage and parent/child relationships around privileged or unusual user contexts
- Logon session and account context evidence for the user whose token is being duplicated or impersonated
- Privileged account activity and administrative session telemetry
Detection direction
- Validate coverage on Windows systems where privileged users log on interactively or where high-value services run.
- Tune for behavior chains: suspicious token duplication or impersonation plus unusual process context, privilege escalation, or follow-on administrative activity is more meaningful than an isolated API observation.
- Review false positives from legitimate administration, service behavior, and software that uses impersonation for valid delegation.
- Correlate token impersonation signals with related ATT&CK context, especially Access Token Manipulation and Create Process with Token when a duplicated token is used to start a new process instead of being attached to an existing one.
- Confirm whether detections preserve enough evidence for IR: original process, impersonated user, target thread/process, logon session, timestamp, and subsequent actions.
Mitigation priorities
- Enforce user account management practices that reduce unnecessary standing access and remove stale or over-privileged accounts.
- Strengthen privileged account management: least privilege, scoped administrative roles, monitoring of privileged account use, and accountability through logging and auditing.
- Limit where privileged accounts can log on so fewer reusable high-value tokens exist on endpoints.
- Review administrative workflows that require interactive privileged sessions on shared or exposed Windows systems.
- Use ATT&CK-mapped detection and response testing to confirm that token impersonation behaviors produce actionable evidence, not just generic privilege-escalation alerts.
Analyst notes and limits
The relationship set increases the materiality of this technique: ATT&CK associates it with APT28, FIN8, HomeLand Justice, and multiple software entries including Cobalt Strike, Emotet, REvil, BitPaymer, Shamoon, Stuxnet, Siloscape, and others. These relationships should guide threat-informed prioritization, but local risk depends on the organization’s Windows estate, privileged account model, and telemetry depth.
MITRE does not provide official detection text for this object in the supplied fields. Telemetry and detection recommendations are therefore derived from the official behavior description, Windows API references, tactics, platform, mitigations, and the DET0482 detection-strategy relationship. This take does not assert current exploitation, customer exposure, or guaranteed detection coverage.
Token Impersonation/Theft
Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`.[1] The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread.
An adversary may perform Token Impersonation/Theft when they have a specific, existing process they want to assign the duplicated token to. For example, this may be useful for when the target user has a non-network logon session on the system.
When an adversary would instead use a duplicated token to create a new process rather than attaching to an existing process, they can additionally Create Process with Token using `CreateProcessWithTokenW` or `CreateProcessAsUserW`. Token Impersonation/Theft is also distinct from Make and Impersonate Token in that it refers to duplicating an existing token, rather than creating a new one.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1134 | Access Token Manipulation | This object subtechnique of Access Token Manipulation. |
Groups, software, and campaigns
G0007: APT28
APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.[1][2] This group has been active since at least 2004.[3][4][5][6][7][8][9][10][11][12][13]
APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.[5] In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.[14] Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.
G0061: FIN8
FIN8 is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. In June 2021, security researchers detected FIN8 switching from targeting point-of-sale (POS) devices to distributing a number of ransomware variants.[1][2][3][4]
S0182: FinFisher
FinFisher is a government-grade commercial surveillance spyware reportedly sold exclusively to government agencies for use in targeted and lawful criminal investigations. It is heavily obfuscated and uses multiple anti-analysis techniques. It has other variants including Wingbird. [1] [2] [3] [4] [5]
S0367: Emotet
S9033: Fooder
Fooder is a custom 64-bit C/C++ loader used by MuddyWater that can decrypt and reflectively load embedded payloads such as a go-socks5 proxy utility, the open-source HackBrowserData infostealer, or the MuddyViper backdoor. Fooder has frequently masqueraded as an entertainment executable, such as the Snake game (e.g., `Snake_Game.exe`).[1]
S1229: Havoc
Havoc is an open-source post-exploitation command and control (C2) framework first released on GitHub in October 2022 by C5pider (Paul Ungur), who continues to maintain and develop it with community contributors. Havoc provides a wide range of offensive security capabilities and has been adopted by multiple threat actors to establish and maintain control over compromised systems.
S0603: Stuxnet
Stuxnet was the first publicly reported malware to specifically target industrial control systems devices. Stuxnet is a large and complex malware that utilized multiple behaviors, including numerous zero-day vulnerabilities, a sophisticated Windows rootkit, and network infection routines.[1][2][3][4] Stuxnet was discovered in 2010, with some components being used as early as November 2008.[1]
S0154: Cobalt Strike
Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”. Cobalt Strike’s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system.[1]
In addition to its own capabilities, Cobalt Strike leverages the capabilities of other well-known tools such as Metasploit and Mimikatz.[1]
S1011: Tarrask
S0692: SILENTTRINITY
SILENTTRINITY is an open source remote administration and post-exploitation framework primarily written in Python that includes stagers written in Powershell, C, and Boo. SILENTTRINITY was used in a 2019 campaign against Croatian government agencies by unidentified cyber actors.[1][2]
S0570: BitPaymer
BitPaymer is a ransomware variant first observed in August 2017 targeting hospitals in the U.K. BitPaymer uses a unique encryption key, ransom note, and contact information for each operation. BitPaymer has several indicators suggesting overlap with the Dridex malware and is often delivered via Dridex.[1]
S0140: Shamoon
Shamoon is wiper malware that was first used by an Iranian group known as the "Cutting Sword of Justice" in 2012. Other versions known as Shamoon 2 and Shamoon 3 were observed in 2016 and 2018. Shamoon has also been seen leveraging RawDisk and Filerase to carry out data wiping tasks. Analysis has linked Shamoon with Kwampirs based on multiple shared artifacts and coding patterns.[1] The term Shamoon is sometimes used to refer to the group using the malware as well as the malware itself.[2][3][4][5]
S0439: Okrum
S0456: Aria-body
C0038: HomeLand Justice
HomeLand Justice was a disruptive cyber campaign conducted by Iranian state-affiliated actors against Albanian government networks in July and September 2022. The activity combined ransomware, wiper malware, and data leak operations. Initial access for HomeLand Justice was established as early as May 2021, and threat actors moved laterally, exfiltrated sensitive information, and maintained persistence for approximately 14 months prior to the destructive phase of the operation. Responsibility was claimed by the "HomeLand Justice" front, which framed the campaign as retaliation against the Mujahedeen-e Khalq (MEK), an Iranian opposition group with a presence in Albania. Multiple Iran-nexus groups are assessed to have participated in the campaign, including HEXANE who probed victim infrastructure.[1][2][3] A second wave of attacks was launched in September 2022 using similar tactics following public attribution of the previous activity to Iran and the severing of diplomatic ties between Iran and Albania.[3]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 2.0 | Current bundle | 8ab32ce9d473… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
DuplicateToken function
Microsoft. (2021, October 12). DuplicateToken function (securitybaseapi.h). Retrieved January 8, 2024.
Open source URL -
[2]
mitre-attack T1134.001Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.