T1134.002Privilege EscalationStealth
Create Process with Token
Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as CreateProcessWithTokenW and runas. Creating processes with a token not associated with the current user may require the credentials of the target user, specific privileges to…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
7 Sigma rules tagged T1134.002Create Process with TokenT1134.0027 general rules
- Meterpreter or Cobalt Strike Getsystem Service Installation - Securityhightest
- Meterpreter or Cobalt Strike Getsystem Service Installation - Systemhightest
- Potential Meterpreter/CobaltStrike Activityhightest
- PUA - AdvancedRun Suspicious Executionhightest
- Suspicious Child Process Created as Systemhightest
- RedSun - Conhost.exe Spawned by TieringEngineService.exehighexperimental
- PUA - AdvancedRun Executionmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Create Process with Token
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.