T1134Privilege EscalationStealth
Access Token Manipulation
Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the…
CVEs6
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.5
Reports1
Detections
4 Sigma rules tagged T1134Access Token ManipulationT11344 general rules
- HackTool - NoFilter Executionhightest
- Suspicious SYSTEM User Process Creationhightest
- Potentially Suspicious Explicit Credential Local Logonmediumexperimental
- Suspicious Cross-User Process Spawnmediumexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Access Token Manipulation
6 CVEs, by priority. Each link shows its badge.- CVE-2016-0099Microsoft Windows Secondary Logon Service Privilege Escalation VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 7.8T1068Exploitation for Privilege EscalationT1134Access Token ManipulationAI mapping from the description · primary impact37.0%Top 1.5%78.2priority
- CVE-2025-29824Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 7.8T1068Exploitation for Privilege EscalationT1134Access Token ManipulationAI mapping from the description · primary impact19.3%Top 2.7%77.9priority
- CVE-2019-0543Microsoft Windows Privilege Escalation VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 7.8T1068Exploitation for Privilege EscalationT1134Access Token ManipulationAI mapping from the description · primary impact4.7%Top 8.2%76.8priority
- CVE-2002-0367Microsoft Windows Privilege Escalation VulnerabilityMicrosoft · WindowsKEVPublic exploitHigh · 7.8T1068Exploitation for Privilege EscalationT1134Access Token ManipulationAI mapping from the description · primary impact4.9%Top 7.9%66.9priority
- CVE-2023-36033Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation VulnerabilityMicrosoft · WindowsKEVHigh · 7.8T1068Exploitation for Privilege EscalationT1134Access Token ManipulationAI mapping from the description · primary impact10.9%Top 4.1%62.6priority
- CVE-2020-0981A security feature bypass vulnerability exists when Windows fails to properly handle token relationships.An attacker…Microsoft · Windows 10 Version 1909 for 32-bit SystemsPublic exploitT1134Access Token ManipulationT1068Exploitation for Privilege Escalation+1 moreMITRE CTID mapping of the CVE · primary impact1.3%Top 30%19.0priority