Last updated
Last updated
Name: Token Impersonation/Theft
ID: T1134.001
Tactics: ,
Technique:
Token Impersonation/Theft (T1134.001) is a sub-technique of the MITRE ATT&CK framework under the broader "Access Token Manipulation" technique (T1134). It refers specifically to adversaries stealing or duplicating legitimate access tokens used by operating systems to authenticate and authorize user or system processes. Access tokens represent security contexts of users or services, and obtaining them allows attackers to assume identities, escalate privileges, and move laterally within compromised environments. Attackers commonly leverage token theft to bypass authentication mechanisms, evade detection, and execute malicious activities under legitimate user contexts.
Token impersonation or theft involves capturing or duplicating access tokens that operating systems generate upon successful authentication. These tokens contain security identifiers (SIDs), group memberships, privileges, and session details essential for authorization decisions. Attackers commonly exploit this mechanism through various methods:
Process Injection and Token Duplication:
Attackers inject malicious code into legitimate processes that possess privileged tokens.
Using Windows API calls like DuplicateTokenEx, attackers duplicate existing tokens to create new tokens with identical privileges.
The duplicated tokens are then used in new processes or threads, allowing attackers to impersonate the original user or service.
Token Extraction from Memory:
Tools such as Mimikatz, Meterpreter, or Cobalt Strike are used to extract tokens directly from volatile memory.
Attackers enumerate processes, identify privileged tokens, and extract them for reuse in malicious contexts.
Pass-the-Token Attacks:
Attackers leverage stolen tokens to authenticate to remote systems without requiring user passwords or credentials.
This technique facilitates lateral movement and privilege escalation within networks.
Abuse of Windows APIs and System Calls:
Attackers frequently use APIs such as OpenProcessToken, ImpersonateLoggedOnUser, and SetThreadToken to manipulate and impersonate tokens.
These APIs are legitimate and commonly used by system administrators, making detection challenging.
Token Impersonation/Theft typically appears in multiple stages of an attack lifecycle, including:
Privilege Escalation:
Attackers leverage token theft to escalate from lower-privileged accounts to higher-privileged accounts or system-level privileges.
Credential Access and Persistence:
Stolen tokens allow attackers to maintain persistent access without requiring repeated credential theft or brute-force attacks.
Lateral Movement:
Attackers use compromised tokens to authenticate to other systems within the network, enabling lateral traversal and access to sensitive resources.
Defense Evasion:
Attackers impersonate legitimate users to evade detection systems that rely on anomaly detection or behavior analytics.
Execution and Command-and-Control (C2):
Attackers execute malicious payloads or commands under impersonated identities, reducing visibility and suspicion.
Detection of Token Impersonation/Theft involves a combination of monitoring, logging, and analysis techniques:
Monitoring Windows Security Event Logs:
Observe unusual event log entries related to token manipulation, such as Event ID 4624 (logon events) and Event ID 4672 (special privileges assigned).
Identify discrepancies in logon types, unusual logon times, or unexpected user activity patterns.
Endpoint Detection and Response (EDR) Solutions:
EDR tools detect suspicious API calls, process injections, and token duplication attempts.
Tools like CrowdStrike, Carbon Black, and Microsoft Defender ATP provide visibility into token manipulation activities.
Behavioral Analytics and Anomaly Detection:
Implement user and entity behavior analytics (UEBA) to detect anomalous user activities, such as unexpected privilege escalation or lateral movement.
Identify deviations from baseline user behavior, including unusual processes running under privileged user contexts.
Memory Analysis and Forensics:
Conduct memory forensics using tools like Volatility, Rekall, or Redline to identify malicious token manipulations and memory-resident token theft tools.
Detect presence of known token theft tools (e.g., Mimikatz) through memory signatures and indicators.
Indicators of Compromise (IoCs):
Presence of known malicious binaries or scripts associated with token theft (e.g., Mimikatz, PowerSploit).
Suspicious API calls (DuplicateTokenEx, SetThreadToken, ImpersonateLoggedOnUser) from unusual processes.
Network traffic patterns indicative of lateral movement or unauthorized access attempts.
Early detection of Token Impersonation/Theft is crucial due to its severe potential impacts:
Privilege Escalation:
Attackers can quickly escalate privileges to gain administrative or system-level access, enabling full control over targeted systems.
Lateral Movement and Network Compromise:
Token theft facilitates attackers' lateral movement across the network, potentially compromising multiple systems and sensitive data.
Data Exfiltration and Breaches:
Attackers using impersonated tokens can access and exfiltrate sensitive data unnoticed, causing significant financial, reputational, and regulatory impacts.
Persistence and Long-Term Compromise:
Token theft allows attackers to maintain persistent access without repeated credential theft, making detection and remediation more difficult.
Difficulty in Attribution and Incident Response:
Attackers impersonating legitimate users complicate attribution efforts, hindering effective incident response and forensic investigations.
Real-world examples illustrating the use of Token Impersonation/Theft techniques include:
Mimikatz Usage in Advanced Persistent Threat (APT) Campaigns:
Multiple APT groups have leveraged Mimikatz to extract tokens from memory, enabling privilege escalation and lateral movement.
Notable incidents include attacks by APT28 (Fancy Bear), APT29 (Cozy Bear), and FIN7, who extensively used token theft to maintain stealthy persistence.
Cobalt Strike Framework in Targeted Attacks:
Attackers frequently employ Cobalt Strike's "steal_token" and "make_token" commands to impersonate legitimate users and administrators.
This capability has been observed in ransomware attacks, espionage campaigns, and targeted intrusions.
NotPetya Malware Incident:
The NotPetya ransomware incident leveraged token theft techniques to escalate privileges and propagate across internal networks rapidly.
Attackers used stolen tokens to execute commands remotely, causing widespread disruption and significant financial damage.
Operation Cloud Hopper:
APT10 utilized token impersonation extensively to compromise managed service providers (MSPs) and gain unauthorized access to client networks.
Attackers stole tokens to impersonate legitimate administrators, facilitating lateral movement and data exfiltration from multiple organizations.
Ryuk and Conti Ransomware Attacks:
Ryuk and Conti ransomware operators frequently leverage token theft methods to escalate privileges and move laterally within target networks.
Attackers use stolen tokens to disable security tools, encrypt critical systems, and exfiltrate sensitive data before deploying ransomware payloads.
Token Impersonation/Theft [T1134.001]