Access Token Manipulation: Token Impersonation/Theft

APT28 has used CVE-2015-1701 to access the SYSTEM token and copy it into the current process as part of privilege escalation.^[2]

Aria-body has the ability to duplicate a token from ntprint.exe.^[3]

BADHATCH can impersonate a lsass.exe or vmtoolsd.exe token.^[4]

BitPaymer can use the tokens of users to create processes on infected systems.^[5]

Cobalt Strike can steal access tokens from exiting processes.^[6][7]

Emotet has the ability to duplicate the user’s token.^[8] For example, Emotet may use a variant of Google’s ProtoBuf to send messages that specify how code will be executed.^[9]

FIN8 has used a malicious framework designed to impersonate the lsass.exe/vmtoolsd.exe token.^[10][11]

FinFisher uses token manipulation with NtFilterToken as part of UAC bypass.^[12][13]

During HomeLand Justice, threat actors used custom tooling to acquire tokens using ImpersonateLoggedOnUser/SetThreadToken.^[14]

Okrum can impersonate a logged-on user's security context using a call to the ImpersonateLoggedOnUser API.^[15]

Pupy can obtain a list of SIDs and provide the option for selecting process tokens to impersonate.^[16]

REvil can obtain the token from the user that launched the explorer.exe process to avoid affecting the desktop of the SYSTEM user.^[17]

Shamoon can impersonate tokens using LogonUser, ImpersonateLoggedOnUser, and ImpersonateNamedPipeClient.^[18]

SILENTTRINITY can find a process owned by a specific user and impersonate the associated token.^[19]

Siloscape impersonates the main thread of CExecSvc.exe by calling NtImpersonateThread.^[20]

Stuxnet attempts to impersonate an anonymous token to enumerate bindings in the service control manager.^[21]

Tarrask leverages token theft to obtain lsass.exe security permissions.^[22]

Limit permissions so that users and user groups cannot create tokens. This setting should be defined for the local system account only. GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Create a token object. ^[23] Also define who can create a process level token to only the local and network service through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Replace a process level token.^[24]

Administrators should log in as a standard user but run their tools with administrator privileges using the built-in access token manipulation command runas.^[25]

An adversary must already have administrator level access on the local system to make full use of this technique; be sure to restrict users and accounts to the least privileges they require.